Authentication

The authentication process for a new session on MAG-c performs a lookup in the following order:

1. BNG EP for fixed sessions or APN for FWA sessions
2. authentication flow

The BNG EP or APN lookup returns the following:

• basic configurations for the CP protocol negotiation (for example, the IPoE profile, the PPPoE profile)
• basic session configuration (for example, subscriber identification)
• the authentication flow used to authenticate the session

The authentication flow contains an ordered list of Authentication Databases (ADBs). The MAG-c performs a lookup in each ADB in the list, in the specified order. The lookup returns the following configurations required to create the session:

• session attributes (for example, the SLA profile and the subscriber profile)
• address assignment configuration (for example, the local address pool name)
• optional external AAA authentication (for example, RADIUS)

When both the BNG EP or APN lookup and the authentication flow lookup complete successfully, the MAG-c creates a full forwarding state on the BNG-UP for the session using the session management procedures.

The BNG entry point (EP) provides information needed in the authentication flow. This section describes how to create and configure a BNG EP.

Use the following command to create a BNG EP.

configure mobile-gateway pdn gw-id sx-n4 signaling ibcp bng-entry-point name

configure mobile-gateway pdn 1 sx-n4 signaling ibcp bng-entry-point e1

To define the control packet types that trigger the BNG EP lookup, use the following command:

configure mobile-gateway pdn gw-id sx-n4 signaling ibcp triggers [pppoe-discover] [ipoe-dhcp] [ipoe-dhcpv6] [ipoe-router-solicit]

configure mobile-gateway pdn 1 sx-n4 signaling ibcp triggers ipoe-dhcp

To configure the content of the BNG EP in the BNG profile, use the entry-point command in the config>mobile>profile>bng context.

The following example shows a BNG profile EP configuration.

config>mobile>profile>bng>
----------------------------------------------
    entry-point "e1"
                    match 1 attribute up-ip
                    exit
                    entry "10"
                        ipoe
                            ipoe-profile "mydefault"
                            authentication-flow
                                adb "adb1" "adb2"
                            exit
                        exit
                        match
                            up-ip 172.16.10.50
                        exit
                        pppoe
                            pppoe-profile "pppoeProf1"
                            authentication-flow
                                pap-chap-adb "adb3" "adb4"
                            exit
                        exit
                        no shutdown
                    exit
                    no shutdown
----------------------------------------------

Each ADB entry contains three groups of configuration parameters:

• match criteria
• action parameters
• session creation parameters (for example, sla-profile)

After the MAG-c chooses the best matched entry in the ADB, the MAG-c executes the configured action. The action can be any of the following types:

• reject

  The session authentication fails and no subsequent ADB lookups are performed, even if they are configured as part of the authentication flow.

• accept

  The MAG-c includes the session creation configuration parameters of the chosen ADB entry for the session creation.

• radius

  The MAG-c performs the RADIUS authentication using the RADIUS authentication profile. Configure the RADIUS authentication profile using the radius-authentication-profile command in the config>mobile>profile>bng context. If the RADIUS authentication succeeds, the MAG-c includes the returned RADIUS authentication attributes and the session creation configuration parameters for the session creation. If the RADIUS authentication fails, the session authentication fails.

• local_auth

  The MAG-c performs a PAP/CHAP authentication using the configured username and password in the ADB entry for the PPPoE session. Configure the username using the username command in the config>mobile>profile>adb>entry>match context. Configure the password using the action local-auth command in the config>mobile>profile>adb>entry context.

The MAG-c uses the session creation configuration parameters of all ADBs. The authentication flow contains an ordered list of ADBs. If ADBx comes before ADBy in the ordered list of ADBs, the values of the parameters in ADBy have priority over the values of the parameters in ADBx. For example, an authentication flow contains two ADBs, ADB1 and ADB2. If the matched entry in ADB1 returns sla-profile foo, and the matched entry in ADB2 returns sla-profile bar, a new session is created with sla-profile bar.

If a session creation configuration is not explicitly configured (for example, it equals the default value), the ADB lookup returns no value for this configuration. For example, an authentication flow contains two ADBs, ADB1 and ADB2. If ADB1 returns sla-profile bar, and the matched entry in ADB2 does not contain an explicit configuration for sla-profile (it equals the default value), a new session is created with sla-profile bar.

Some session creation configuration parameters support a special discard keyword. The discard keyword means that the previously returned ADB value for the attribute must be discarded. For example, an authentication flow contains two ADBs, ADB1 and ADB2. If ADB1 returns a value for bng-charging-profile, and ADB2 returns discard for bng-charging-profile, the MAG-c creates the session without bng-charging-profile.

An authentication flow contains the following configuration items:

• trigger packet type; for example, DHCPv4 discovery or PPPoE PADI packet
  Note: For FWA session, the trigger packet type is not explicitly configured. It is always the first session establishment message, such as a GTP Create Session Request message.
• ordered list of one or more ADBs for the specified trigger packet type

When the BNG-UP sends a trigger packet, the MAG-c performs a lookup in each ADB in the list, in the specified order. Each ADB can return session-related configurations. These session-related configurations can be locally configured or returned from an external AAA server.

An IPoE or FWA session has only one authentication flow. A PPPoE session requires at least one of the following independent authentication flows:

• PADI
• PAP/CHAP

If an ADB lookup fails, the session setup fails. The ADB lookup may fail, for example, if an entry is matched with an action reject or if there is an AAA authentication failure.

If all lookups complete successfully, the MAG-c continues session setup using the combined configurations from all ADB lookups. For example, the BNG EP lookup returns two authentication flows for a new PPPoE session. The authentication flows return the following configuration:

• PADI authentication flow with 1 ADB: ADB1 returns PADO delay value
• PAP/CHAP authentication flow with 2 ADBs: ADB2 configures RADIUS authentication, ADB3 returns a local address pool

In this example, the MAG-c uses the combined configuration result from the three ADB lookups to set up the PPPoE session.

Each session requires an APN for service selection, as described in Service selection. The APN can also provide override for specific configurations. If different types of sources return the same type of configuration (for example, an address pool name), the MAG-c uses the value of the source with the highest ranking. The sources are ranked as follows, with the highest ranked first:

1. AAA
2. Local ADB
3. APN

If different sources of the same type (for example, different ADBs) return the same type of configuration, the MAG-c uses the last returned value. For example, if both ADB-1 and ADB-N return an SLA profile name, and ADB-1 returns SLA profile name X and ADB-N returns SLA profile name Y, the system uses SLA profile name Y because it is the last returned value.

Both the BNG EP entries and the ADB entries contain session configuration and one or more ordered match criteria. The match criteria are used in the lookup. The session configuration is used in the creation of the session.

----------------------------------------------
#first match criteria is UP's IP address 
                match 1 attribute up-ip 
                    optional
                exit
#2nd match criteria is Layer 2 access ID
                match 2 attribute l2-access-id
                    optional
                exit
#3rd match criteria is SVLAN
                match 3 attribute s-vlan
                    optional
                exit
                entry "10"
                    match
                        l2-access-id "1/1/2"
                        up-ip 172.16.10.50
                        vlan
                            s-vlan start 100 end 200
                        exit
                    exit
                    subscriber-mgmt
                        sla-profile "entry10"
                        sub-profile "entry10"
                    exit
                    no shutdown
                exit
                entry "20"
                    charging
                        bng-charging-profile "mybngcharging"
                    exit
                    match
                        l2-access-id "1/1/2"
                        up-ip 172.16.10.50
                    exit
                    subscriber-mgmt
                        sla-profile "entry20"
                        sub-profile "entry20"
                    exit
                    no shutdown
                exit
                entry "30"
                    match
                        l2-access-id "1/1/2"
                        vlan
                            s-vlan start 100 end 200
                        exit
                    exit
                    subscriber-mgmt
                        sla-profile "entry30"
                        sub-profile "entry30"
                    exit
                    no shutdown
                exit
                entry "40"
                    match
                        vlan
                            s-vlan start 100 end 200
                        exit
                    exit
                    subscriber-mgmt
                        sla-profile "entry40"
                        sub-profile "entry40"
                    exit
                    no shutdown
                exit
                no shutdown
----------------------------------------------

A new session has the following attributes and values:

• up-ip with value 172.16.10.50
• l2-access-id with value 1/1/2
• s-vlan with value 100

The session matches with all ADB entries. The MAG-c chooses the entry 10 because it has the highest number of matching criteria; that is, three matching criteria.

Assume the entry 10 is shut down. Both the entries 20 and 30 have the highest number of matching criteria; that is, two matching criteria. The MAG-c chooses the entry 20 because it has the matching criteria with the highest priority; that is, up-ip.

Assume all entries except 40 are shutdown. The MAG-c chooses the only matching entry; that is, the entry 40.

To create a session, the MAG-c requires a minimal number of session creation configuration parameters. The table lists the parameters that are required for session creation, as well as the source that contains those parameters.

RADIUS authentication is performed when the action parameter in the best matched ADB entry equals radius. The RADIUS authentication profile defines the behavior of the RADIUS authentication. To define the profile, use the radius-authentication-profile command in the config>mobile>profile>bng context.

RADIUS authentication is triggered by ADB lookup, which means it is possible to have multiple rounds of RADIUS authentications during the authentication flow lookup. If during multiple rounds, the same attributes are returned in the Access-Accept message, the last attribute received is used.

A RADIUS authentication profile contains the following configuration commands:

• radius-group

  The radius-group command contains RADIUS server configuration such as address, port, and shared secret. To define the RADIUS server configuration, use the radius-group command in the config>mobile>profile context. Afterwards, reference this radius-group in the config>mobile>profile>bng>radius-authentication-profile context.

• user-name-format

  The user-name-format command defines the username format for the RADIUS server. To define the username format, use the user-name-format command in the config>mobile>profile>bng>radius-authentication-profile context.

• password

  The password command defines the password of the RADIUS user. To define the password, use the password command in the config>mobile>profile>bng>radius-authentication-profile context.

• include-attribute

  The include-attribute command defines the RADIUS attributes to be included in an Access-Request message. To define the attributes to be included, use the include-attribute command in the config>mobile>profile>bng>radius-authentication-profile context.

The username and password configuration is required for IPoE authentication, PPPoE PADI authentication, and FWA authentication if no PAP/CHAP credentials are provided during FWA session setup.

A RADIUS CoA or a DM message asks for changes in the session or subscriber object.

To enable support for RADIUS CoA and DM messages, use the interface command in the config>mobile>pdn>bng>radius-coa context.

The interface defines one or more listening interfaces for incoming CoA and DM messages, and the shared secrets.

When the MAG-c receives a CoA or DM message, it makes the requested change to the target object. The CMG BNG CUPS RADIUS Attributes list defines the message attributes that can be used to identify one or multiple sessions as target object. Filter on the value yes for the CoA key column to find those attributes in the list. If a subscriber is specified in the request, the MAG-c applies the requested changes to all sessions of the targeted subscriber.

The CoA message contains one or more attributes that define the requested changes; for example, the Alc-SLA-Prof-Str VSA defines a new sla-profile for the target object. For more information about the supported attributes, see the CMG BNG CUPS RADIUS Attributes.

If the MAG-c applies all requested changes successfully to all targeted objects, the MAG-c sends a CoA-ACK message. If the MAG-c can only apply the requested changes partially or only on a subset of the target objects, the MAG-c sends a CoA-NAK message with an ERROR-CAUSE code 506, and rolls back the changes as follows.

• If the change request is for multiple attributes on a single session and only part of the attribute changes are successful, the MAG-c sends a CoA-NAK message with an ERROR-CAUSE code 404, and rolls back the already applied changes.
• If the change request is for multiple attributes on multiple sessions and the changes are only successful for a part of all the target sessions, the MAG-c sends a CoA-NAK message with an ERROR-CAUSE code 506, and rolls back the applied changes for the sessions that were only partially changed. For example, a CoA message requests to change three attributes on five sessions. The MAG-c successfully applies all attribute changes on session 1, session 2, and session 3, but only applies one attribute change successfully on session 4 and session 5. The MAG-c sends a CoA-NAK message and rolls back the attribute change on session 4 and session 5.

A DM message only contains target objects. The MAG-c removes the sessions of the target objects and sends an ACK message. If the target objects do not exist, the MAG-c sends a CoA-NAK message with ERROR-CAUSE code 503.

If a CoA or DM message contains an unsupported attribute, the MAG-c rejects the request with a CoA-NAK message by default. To ignore unsupported attributes, use the ignore-unknown-attributes command in the config>mobile>pdn>bng>radius-coa context.

The example configuration in this section is for the following setup:

• IPoE session
• RADIUS authentication
• address pool pool-up-1 for sessions from BNG-UP 1.1.1.1
• address pool pool-up-2 for sessions from BNG-UP 2.2.2.2
• sla-profile basic, sub-profile basic, and authentication with radius-auth-profile-1 for sessions with s-vlan 100
• sla-profile premium, sub-profile premium, and authentication with radius-auth-profile-2 for sessions with s-vlan 200

To achieve the above setup, an authentication flow with three ADBs is used. In this example, the following is returned.

• ADB adb1 only returns the address pool.
• ADB adb2 only returns the sla-profile and the sub-profile, and performs RADIUS authentication.
• ADB adb3 returns the other configuration parameters.

The following example shows the ADB configuration.

  authentication-database "adb1"
      match 1 attribute up-ip
      exit
      entry "up-1"
          address-assignment
              local-dynamic
                  ipv4-pool "pool-up-1"
              exit
          exit
          match
              up-ip 1.1.1.1
          exit
          no shutdown
      exit
      entry "up-2"
          address-assignment
              local-dynamic
                  ipv4-pool "pool-up-2"
              exit
          exit
          match
              up-ip 2.2.2.2
          exit
          no shutdown
      exit
      no shutdown
  exit
  authentication-database "adb2"
      match 1 attribute s-vlan
      exit
      entry "basic"
          action radius radius-authentication-profile "radius-auth-profile-1"
          match
              vlan
                  s-vlan start 100 end 100
              exit
          exit
          subscriber-mgmt
              sla-profile "basic"
              sub-profile "basic"
          exit
          no shutdown
      exit
      entry "premium"
          action radius radius-authentication-profile "radius-auth-profile-2"
          match
              vlan
                  s-vlan start 200 end 200
              exit
          exit
          subscriber-mgmt
              sla-profile "premium"
              sub-profile "premium"
          exit
          no shutdown
      exit
      no shutdown
  exit
  authentication-database "adb3"
      entry "default"
          apn "mybngvrf"
          interface
              group-interface-template "defaultgroup"
              sap-template "defaultsap"
          exit
          no shutdown
      exit
      no shutdown
  exit

The following example shows the configuration of the BNG EP.

*A:BNG-CPF>config>mobile>profile>bng# info
----------------------------------------------
                entry-point "e1"
                    entry "10"
                        ipoe
                            ipoe-profile "mydefault"
                            authentication-flow
                                adb "adb1" "adb2" "adb3"
                            exit
                        exit
                        no shutdown
                    exit
                    no shutdown
                exit

The following example shows the reference to the BNG EP in the config>mobile>pdn>sx-n4>signaling>ibcp context.

*A:BNG-CPF>config>mobile>pdn>sx-n4# info
----------------------------------------------
                pfcp-association-list "pfcpassoc1"
                interface
                    pfcp "system"
                    ibcp "system"
                exit
                signaling
                    pfcp
                        profile "pfcppro-1"
                    exit
                    ibcp
                        bng-entry-point "e1"
                        triggers ipoe-dhcp
                    exit
                exit