Appendix: Subscriber management in distributed access aggregation devices

This model requires an aggregation network with high-capacity Ethernet-centric aggregation devices that are highly scalable in terms of filter policies, queues, policers, QoS scheduler, and accounting capabilities, which are applied to subscribers as part of subscriber management. These nodes are referred to as Broadband Service Aggregators and are highly distributed, connecting large number of access nodes to the VPLS aggregation network. Sometimes this deployment is referred to as a "bridged model in distributed service edge".

Through Layer 2 aggregation switches, subscriber traffic is aggregated toward the Layer 3 edge router. This edge router terminates Layer 2 access and routes subscriber traffic over various transport technologies (such as IP, MPLS, VXLAN, and SRv6) with the full set of routing protocols, including multicast routing. The edge router supports sophisticated QoS for per service and per-content or source differentiation.

The connectivity between BSAs and the edge router is a secure VPLS infrastructure shown in Bridged Broadband Service Delivery Architecture. This VPLS forms a multipoint Ethernet network with security extensions to prevent unauthorized communication, denial of service, and theft of service. One of the advantages of using VPLS for this application is that VPLS instances can be automatically established over both "hub and spoke" and ring topologies providing sub-50 ms resilience. Regardless of the fiber plant layout, VPLS enables a full mesh to be created between the BSAs and edge router, ensuring efficient traffic distribution and resilience to node or fiber failure.

Other unique features of the BSA and the edge router that contribute to this secure VPLS infrastructure are:

• Using Residential Split Horizon Groups (RSHG), direct user-user bridging is automatically prohibited, without the need for address-specific ACLs.
• RSHG combined with the ARP reply agent perform ARP and broadcast suppression to ensure that addressing information is restricted.
• Protection against theft of service and denial of service is provided by MAC or IP filters automatically populated using DHCP snooping, and by MAC pinning.
• Using the RADIUS interface, it is possible to perform RADIUS authentication of users before allowing a DHCP discover to progress into the network.

This model, subscriber management in distributed access aggregation devices, is considered a legacy model that relies on DHCPv4 snooping functions in BSA for subscriber identification and, therefore, is supported only for IPoEv4 devices. Because IPoEv6 and PPPoEv4/v6 devices are not supported in this model its use has been limited and replaced by the RCO model, where subscribers are terminated on the BNG in a central office location.