RBFS Subscriber Management Configuration

This chapter provides information about the following:

PPPoE Subscriber Management Configuration
IPoE Subscriber Management Configuration
QoS Configuration for PPPoE and IPoE Subscribers

PPPoE Subscriber Management Configuration

PPPoE (Point-to-Point Protocol over Ethernet) is a network protocol that provides connectivity across Ethernet networks. The protocol enables communication between network endpoints and service providers implement PPPoE to connect many hosts on a single Ethernet LAN to the core network through a common device. In RBFS, the PPPoE daemon (pppoed) manages PPPoE and PPP sessions.

To enable PPPoE Subscriber Management, the following configurations are mandatory:

Access Interface Configuration
Access Profile Configuration
AAA (Authentication, Authorization and Accounting) Profile Configuration. Based on the authentication requirement, configure any one of the following:
1. Local Authentication
  1. Pool Configuration
  2. User Profile Configuration
2. RADIUS Authentication
  1. RADIUS Profile Configuration
  2. RADIUS Server Configuration

This solution section discusses RADIUS authentication.

NOTES:

Access interfaces can be configured without VLAN tags (untagged) and with one (single tagged) or two (double tagged) VLAN tags.
There can be more than one interface configured for subscriber management and each interface can reference the same profile.

Configuring PPPoE Subscriber Management

For detailed information about the subscriber configuration options, see the Subscriber Management Configuration Guide.

Configure the access profile pppoe.

set access access-profile pppoe
set access access-profile pppoe instance default
set access access-profile pppoe protocol pppoe enable true
set access access-profile pppoe protocol ppp lcp authentication-protocol PAP
set access access-profile pppoe protocol ppp lcp echo-interval 30
set access access-profile pppoe protocol ppp lcp echo-enable true
set access access-profile pppoe protocol ppp ipcp enable true
set access access-profile pppoe protocol ppp ipcp source-ifl lo-0/0/1/0
set access access-profile pppoe protocol ppp ip6cp enable true
set access access-profile pppoe protocol ra enable true
set access access-profile pppoe protocol ra interval 30
set access access-profile pppoe protocol dhcpv6 enable true
set access access-profile pppoe protocol dhcpv6 lifetime 14400
set access access-profile pppoe protocol dhcpv6 preferred-lifetime 1800
set access access-profile pppoe address-family ipv4 enable true
set access access-profile pppoe address-family ipv4 pool-name poolv4
set access access-profile pppoe address-family ipv4 primary-dns 203.0.113.200
set access access-profile pppoe address-family ipv4 secondary-dns 203.0.113.201
set access access-profile pppoe address-family ipv6 enable true
set access access-profile pppoe address-family ipv6 pool-name poolv6
set access access-profile pppoe address-family ipv6 prefix-delegation-pool-name poolv6pd
set access access-profile pppoe address-family ipv6 primary-dns 2001:db8:0:20::1
set access access-profile pppoe address-family ipv6 secondary-dns 2001:db8:0:20::1
commit

The access profile configuration is shown below.

supervisor@rtbrick: op> show config access access-profile
{
  "rtbrick-config:access-profile": [
    {
      "profile-name": "ipoe",
      "instance": "default",
      "protocol": {
        "ra": {
          "enable": "true",
          "interval": 30
        },
        "dhcp": {
          "enable": "true",
          "lease-time": 3600
        },
        "dhcpv6": {
          "enable": "true",
          "lifetime": 3600
        }
      },
      "address-family": {
        "ipv4": {
          "enable": "true",
          "pool-name": "poolv4_1"
        },
        "ipv6": {
          "enable": "true",
          "pool-name": "poolv6_1",
          "prefix-delegation-pool-name": "poolv6pd_1"
        }
      }
    },
    {
      "profile-name": "pppoe",
      "instance": "default",
      "protocol": {
        "pppoe": {
          "enable": "true"
        },
        "ppp": {
          "lcp": {
            "authentication-protocol": "PAP",
            "echo-interval": 30,
            "echo-enable": "true"
          },
          "ipcp": {
            "enable": "true",
            "source-ifl": "lo-0/0/1/0"
          },
          "ip6cp": {
            "enable": "true"
          }
        },
        "ra": {
          "enable": "true",
          "interval": 30
        },
        "dhcpv6": {
          "enable": "true",
          "lifetime": 14400,
          "preferred-lifetime": 1800
        }
      },
      "address-family": {
        "ipv4": {
          "enable": "true",
          "pool-name": "poolv4",
          "primary-dns": "203.0.113.200",
          "secondary-dns": "203.0.113.201"
        },
        "ipv6": {
          "enable": "true",
          "pool-name": "poolv6",
          "prefix-delegation-pool-name": "poolv6pd",
          "primary-dns": "2001:db8:0:20::1",
          "secondary-dns": "2001:db8:0:20::1"
        }
      }
    }
  ]
}

Configure the Authentication and Accounting (AAA) profile for aaa-profile.

set access aaa-profile aaa-profile
set access aaa-profile aaa-profile session-timeout 0
set access aaa-profile aaa-profile idle-timeout 0
set access aaa-profile aaa-profile aaa-radius-profile radius-profile
set access aaa-profile aaa-profile authentication order RADIUS
set access aaa-profile aaa-profile accounting order RADIUS
set access aaa-profile aaa-profile accounting interim-interval 86400
set access aaa-profile aaa-profile accounting ingress accounting-source POLICER
set access aaa-profile aaa-profile accounting egress accounting-source CLASS
commit

The access AAA configuration is shown below.

supervisor@rtbrick: op> show config access aaa-profile
{
  "rtbrick-config:aaa-profile": [
    {
      "profile-name": "aaa-profile",
      "session-timeout": 0,
      "idle-timeout": 0,
      "aaa-radius-profile": "radius-profile",
      "authentication": {
        "order": "RADIUS"
      },
      "accounting": {
        "order": "RADIUS",
        "interim-interval": 86400,
        "ingress": {
          "accounting-source": "POLICER"
        },
        "egress": {
          "accounting-source": "CLASS"
        }
      }
    }
  ]
}

Configure the access interface. Double-tagged interface is configured in this case as the access interface (ifp-0/1/23). The interface configuration assigns the access type, access profile, AAA profile, and further optional attributes like service-profile to the specified access interface.

Commands for PPPoE:

set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100
set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100 access-type PPPoE
set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100 access-profile-name pppoe
set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100 service-profile-name subs_service
set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100 aaa-profile-name aaa-profile
commit

The double-tagged access interface configuration (for PPPoE) is shown below.

supervisor@rtbrick: op> show config access interface double-tagged ifp-0/1/23
{
  "rtbrick-config:double-tagged": [
    {
      "interface-name": "ifp-0/1/23",
      "outer-vlan-min": 1001,
      "outer-vlan-max": 1100,
      "inner-vlan-min": 1001,
      "inner-vlan-max": 1100,
      "access-type": "PPPoE",
      "access-profile-name": "pppoe",
      "service-profile-name": "subs_service",
      "aaa-profile-name": "aaa-profile"
    }
  ]
}

Commands for IPoE:

set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 access-type IPoE
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 access-profile-name ipoe
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 service-profile-name subs_service
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 aaa-profile-name aaa-profile
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 gateway-ifl lo-0/0/1/0
commit

The double-tagged access interface configuration (for IPoE) is shown below.

supervisor@rtbrick: op> show config access interface double-tagged ifp-0/1/23
{
  "rtbrick-config:double-tagged": [
    {
      "interface-name": "ifp-0/1/23",
      "outer-vlan-min": 2001,
      "outer-vlan-max": 2100,
      "inner-vlan-min": 1001,
      "inner-vlan-max": 1100,
      "access-type": "IPoE",
      "access-profile-name": "ipoe",
      "service-profile-name": "subs_service",
      "aaa-profile-name": "aaa-profile",
      "gateway-ifl": "lo-0/0/1/0"
    }
  ]
}

In this solution, we configure AAA authentication and accounting with RADIUS. To use RADIUS authentication and accounting both the RADIUS profile and RADIUS server configurations (see below) must be configured.

Configure RADIUS profile radius-profile.

set access radius-profile radius-profile
set access radius-profile radius-profile nas-ip-address 192.0.2.74
set access radius-profile radius-profile nas-port-format DEFAULT
set access radius-profile radius-profile nas-port-type Ethernet
set access radius-profile radius-profile authentication radius-server-profile-name radius
set access radius-profile radius-profile accounting radius-server-profile-name radius
commit

The RADIUS profile configuration is shown below.

supervisor@rtbrick: op> show config access radius-profile radius-profile
{
  "rtbrick-config:radius-profile": [
    {
      "profile-name": "radius-profile",
      "nas-ip-address": "192.0.2.74",
      "nas-port-format": "DEFAULT",
      "nas-port-type": "Ethernet",
      "authentication": {
        "radius-server-profile-name": [
          "radius"
          ]
      },
      "accounting": {
        "radius-server-profile-name": [
          "radius"
          ]
      }
    }
  ]
}

Configure the RADIUS server radius.

set access radius-server radius
set access radius-server radius address 192.0.2.34
set access radius-server radius source-address 192.0.2.74
set access radius-server radius secret-encrypted-text $2b2feb12f730107454b1be6a0f8242b0f
set access radius-server radius routing-instance default
set access radius-server radius rate 300
set access radius-server radius authentication enable true
set access radius-server radius authentication retry 3
set access radius-server radius authentication timeout 5
set access radius-server radius accounting enable true
set access radius-server radius accounting timeout 30
set access radius-server radius coa enable true
commit

The attribute secret-plain-text is converted to secret-encrypted-text in the show command output and the value is hashed.

The RADIUS server configuration is shown below.

supervisor@rtbrick: op> show config access radius-server radius
{
  "rtbrick-config:radius-server": [
    {
      "server-name": "radius",
      "address": "192.0.2.34",
      "source-address": "192.0.2.74",
      "secret-encrypted-text": "$2b2feb12f730107454b1be6a0f8242b0f",
      "routing-instance": "default",
      "rate": 300,
      "authentication": {
        "enable": "true",
        "retry": 3,
        "timeout": 5
      },
      "accounting": {
        "enable": "true",
        "timeout": 30
      },
      "coa": {
        "enable": "true"
      }
    }
  ]
}

Configure the IPv4 and IPv6 access pools.

set access pool poolv4
set access pool poolv4 ipv4-address low 203.0.113.1
set access pool poolv4 ipv4-address high 203.0.113.64
set access pool poolv4_1
set access pool poolv4_1 ipv4-address low 203.0.113.65
set access pool poolv4_1 ipv4-address high 203.0.113.129
set access pool poolv6
set access pool poolv6 ipv6-prefix low 2001:db8:0:1::/64
set access pool poolv6 ipv6-prefix high 2001:db8:0:10::/64
set access pool poolv6_1
set access pool poolv6_1 ipv6-prefix low 2001:db8:0:20::/64
set access pool poolv6_1 ipv6-prefix high 2001:db8:0:40::/64
set access pool poolv6pd
set access pool poolv6pd ipv6-prefix low 2001:db8:0:50::/64
set access pool poolv6pd ipv6-prefix high 2001:db8:0:60::/64
set access pool poolv6pd_1
set access pool poolv6pd_1 ipv6-prefix low 2001:db8:0:100::/64
set access pool poolv6pd_1 ipv6-prefix high 2001:db8:0:4000::/64

commit

The access pool configuration is shown below.

supervisor@rtbrick: op> show config access pool
{
  "rtbrick-config:pool": [
    {
      "pool-name": "poolv4",
      "ipv4-address": {
        "low": "203.0.113.1",
        "high": "203.0.113.64"
      }
    },
    {
      "pool-name": "poolv4_1",
      "ipv4-address": {
        "low": "203.0.113.65",
        "high": "203.0.113.129"
      }
    },
    {
      "pool-name": "poolv6",
      "ipv6-prefix": {
        "low": "2001:db8:0:1::/64",
        "high": "2001:db8:0:10::/64"
      }
    },
    {
      "pool-name": "poolv6_1",
      "ipv6-prefix": {
        "low": "2001:db8:0:20::/64",
        "high": "2001:db8:0:40::/64"
      }
    },
    {
      "pool-name": "poolv6pd",
      "ipv6-prefix": {
        "low": "2001:db8:0:50::/64",
        "high": "2001:db8:0:60::/64"
      }
    },
    {
      "pool-name": "poolv6pd_1",
      "ipv6-prefix": {
        "low": "2001:db8:0:100::/64",
        "high": "2001:db8:0:4000::/64"
      }
    }
  ]
}

IPoE Subscriber Management Configuration

IP-over-Ethernet (IPoE) is an access technology that uses DHCP for IPv4 and DHCPv6 for IPv6 where both protocols are handled in the IPoE daemon (ipoed). IPoE subscribers are identified by IFP, VLANs and client MAC addresses.

The dynamic creation of IPoE subscribers is triggered by DHCPv4 discover or DHCPv6 solicit request from the subscriber. Response is postponed until the subscriber is successfully authenticated using the known authentication methods such as local or RADIUS, however authentication is not mandatory. After the authentication phase, IPv4/IPv6/IPv6-PD address is allocated to the subscriber either from the local pool or from RADIUS.

To enable IPoE Subscriber Management, the following configurations are mandatory:

Access Interface Configuration
Access Profile Configuration
AAA (Authentication, Authorization and Accounting) Profile Configuration. Based on the authentication requirement, configure any one of the following:
1. Local Authentication
  1. Pool Configuration
  2. User Profile Configuration
2. RADIUS Authentication
  1. RADIUS Profile Configuration
  2. RADIUS Server Configuration

This solution section discusses RADIUS authentication.

NOTES:

Access interfaces can be configured without VLAN tags (untagged) and with one (single tagged) or two (double tagged) VLAN tags.
There can be more than one interface configured for subscriber management and each interface can reference the same profile.

Configuring IPoE Subscriber Management

For detailed information about the subscriber configuration options, see the Subscriber Management Configuration Guide.

Configure the access profile ipoe.

set access access-profile ipoe
set access access-profile ipoe instance default
set access access-profile ipoe protocol ra enable true
set access access-profile ipoe protocol ra interval 30
set access access-profile ipoe protocol dhcp enable true
set access access-profile ipoe protocol dhcp lease-time 3600
set access access-profile ipoe protocol dhcpv6 enable true
set access access-profile ipoe protocol dhcpv6 lifetime 3600
set access access-profile ipoe address-family ipv4 enable true
set access access-profile ipoe address-family ipv4 pool-name poolv4_1
set access access-profile ipoe address-family ipv6 enable true
set access access-profile ipoe address-family ipv6 pool-name poolv6_1
set access access-profile ipoe address-family ipv6 prefix-delegation-pool-name poolv6pd_1
commit

The access profile configuration is shown below.

supervisor@rtbrick: op> show config access access-profile

{
  "rtbrick-config:access-profile": [
    {
      "profile-name": "ipoe",
      "instance": "default",
      "protocol": {
        "ra": {
          "enable": "true",
          "interval": 30
        },
        "dhcp": {
          "enable": "true",
          "lease-time": 3600
        },
        "dhcpv6": {
          "enable": "true",
          "lifetime": 3600
        }
      },
      "address-family": {
        "ipv4": {
          "enable": "true",
          "pool-name": "poolv4_1"
        },
        "ipv6": {
          "enable": "true",
          "pool-name": "poolv6_1",
          "prefix-delegation-pool-name": "poolv6pd_1"
        }
      }
    }
  ]
}

Configure the Authentication and Accounting (AAA) profile for aaa-profile.

set access aaa-profile aaa-profile
set access aaa-profile aaa-profile session-timeout 0
set access aaa-profile aaa-profile idle-timeout 0
set access aaa-profile aaa-profile aaa-radius-profile radius-profile
set access aaa-profile aaa-profile authentication order RADIUS
set access aaa-profile aaa-profile accounting order RADIUS
set access aaa-profile aaa-profile accounting interim-interval 86400
set access aaa-profile aaa-profile accounting ingress accounting-source POLICER
set access aaa-profile aaa-profile accounting egress accounting-source CLASS
commit

The access AAA configuration is shown below.

supervisor@rtbrick: op> show config access aaa-profile
{
  "rtbrick-config:aaa-profile": [
    {
      "profile-name": "aaa-profile",
      "session-timeout": 0,
      "idle-timeout": 0,
      "aaa-radius-profile": "radius-profile",
      "authentication": {
        "order": "RADIUS"
      },
      "accounting": {
        "order": "RADIUS",
        "interim-interval": 86400,
        "ingress": {
          "accounting-source": "POLICER"
        },
        "egress": {
          "accounting-source": "CLASS"
        }
      }
    }
  ]
}

Configure the access interface. Double-tagged interface is configured in this case as the access interface (ifp-0/1/8). The interface configuration assigns the access type, access profile, AAA profile, and further optional attributes like service-profile to the specified access interface.

set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 access-type IPoE
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 access-profile-name ipoe
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 service-profile-name subs_service
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 aaa-profile-name aaa-profile
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 gateway-ifl lo-0/0/1/0
commit

The double-tagged access interface configuration is shown below.

supervisor@rtbrick: op> show config access interface double-tagged ifp-0/1/23
    {
      "interface-name": "ifp-0/1/23",
      "outer-vlan-min": 2001,
      "outer-vlan-max": 2100,
      "inner-vlan-min": 1001,
      "inner-vlan-max": 1100,
      "access-type": "IPoE",
      "access-profile-name": "ipoe",
      "service-profile-name": "subs_service",
      "aaa-profile-name": "aaa-profile",
      "gateway-ifl": "lo-0/0/1/0"
    }

In this solution, we configure AAA authentication and accounting with RADIUS. To use RADIUS authentication and accounting both the RADIUS profile and RADIUS server configurations (see below) must be configured.

Configure RADIUS profile radius-profile.

set access radius-profile radius-profile
set access radius-profile radius-profile nas-ip-address 192.0.2.74
set access radius-profile radius-profile nas-port-format DEFAULT
set access radius-profile radius-profile nas-port-type Ethernet
set access radius-profile radius-profile authentication radius-server-profile-name radius
set access radius-profile radius-profile accounting radius-server-profile-name radius
commit

The RADIUS profile configuration is shown below.

supervisor@rtbrick: op> show config access radius-profile radius-profile
{
  "rtbrick-config:radius-profile": [
    {
      "profile-name": "radius-profile",
      "nas-ip-address": "192.0.2.74",
      "nas-port-format": "DEFAULT",
      "nas-port-type": "Ethernet",
      "authentication": {
        "radius-server-profile-name": [
          "radius"
          ]
      },
      "accounting": {
        "radius-server-profile-name": [
          "radius"
          ]
      }
    }
  ]
}

Configure the RADIUS server radius.

set access radius-server radius
set access radius-server radius address 192.0.2.34
set access radius-server radius source-address 192.0.2.74
set access radius-server radius secret-encrypted-text $2b2feb12f730107454b1be6a0f8242b0f
set access radius-server radius routing-instance default
set access radius-server radius rate 300
set access radius-server radius authentication enable true
set access radius-server radius authentication retry 3
set access radius-server radius authentication timeout 5
set access radius-server radius accounting enable true
set access radius-server radius accounting timeout 30
set access radius-server radius coa enable true
commit

The attribute` secret-plain-text` will be converted to secret-encrypted-text in the show command output and value will be hashed.

The RADIUS server configuration is shown below.

ssupervisor@rtbrick: op> show config access radius-server radius
{
  "rtbrick-config:radius-server": [
    {
      "server-name": "radius",
      "address": "192.0.2.34",
      "source-address": "192.0.2.74",
      "secret-encrypted-text": "$2b2feb12f730107454b1be6a0f8242b0f",
      "routing-instance": "default",
      "rate": 300,
      "authentication": {
        "enable": "true",
        "retry": 3,
        "timeout": 5
      },
      "accounting": {
        "enable": "true",
        "timeout": 30
      },
      "coa": {
        "enable": "true"
      }
    }
  ]
}

Configure the IPv4 and IPv6 access pools.

set access pool poolv4
set access pool poolv4 ipv4-address low 203.0.113.1
set access pool poolv4 ipv4-address high 203.0.113.64
set access pool poolv4_1
set access pool poolv4_1 ipv4-address low 203.0.113.65
set access pool poolv4_1 ipv4-address high 203.0.113.129
set access pool poolv6
set access pool poolv6 ipv6-prefix low 2001:db8:0:1::/64
set access pool poolv6 ipv6-prefix high 2001:db8:0:10::/64
set access pool poolv6_1
set access pool poolv6_1 ipv6-prefix low 2001:db8:0:20::/64
set access pool poolv6_1 ipv6-prefix high 2001:db8:0:40::/64
set access pool poolv6pd
set access pool poolv6pd ipv6-prefix low 2001:db8:0:50::/64
set access pool poolv6pd ipv6-prefix high 2001:db8:0:60::/64
set access pool poolv6pd_1
set access pool poolv6pd_1 ipv6-prefix low 2001:db8:0:100::/64
set access pool poolv6pd_1 ipv6-prefix high 2001:db8:0:4000::/64
commit

The access pool configuration is shown below.

supervisor@rtbrick: op> show config access pool
{
  "rtbrick-config:pool": [
    {
      "pool-name": "poolv4",
      "ipv4-address": {
        "low": "203.0.113.1",
        "high": "203.0.113.64"
      }
    },
    {
      "pool-name": "poolv4_1",
      "ipv4-address": {
        "low": "203.0.113.65",
        "high": "203.0.113.129"
      }
    },
    {
      "pool-name": "poolv6",
      "ipv6-prefix": {
        "low": "2001:db8:0:1::/64",
        "high": "2001:db8:0:10::/64"
      }
    },
    {
      "pool-name": "poolv6_1",
      "ipv6-prefix": {
        "low": "2001:db8:0:20::/64",
        "high": "2001:db8:0:40::/64"
      }
    },
    {
      "pool-name": "poolv6pd",
      "ipv6-prefix": {
        "low": "2001:db8:0:50::/64",
        "high": "2001:db8:0:60::/64"
      }
    },
    {
      "pool-name": "poolv6pd_1",
      "ipv6-prefix": {
        "low": "2001:db8:0:100::/64",
        "high": "2001:db8:0:4000::/64"
      }
    }
  ]
}

Quality of Service (QoS) Configuration

Following are the steps involved in configuring and verifying IPoE and PPPoE QoS:

Enabling System Platform Profile for Single Queue Subscribers
Configuring service profile to enable QoS on subscriber

For detailed information about the QoS configuration options, see HQoS Configuration Guide.

Enabling System Platform Profile for Single Q Subscribers

System reboot is required after enabling the system platform profile.

Enable system platform profile for single queue subscribers

set system platform profile nat_1q
commit

The configuration of the system platform profile named nat_1q is shown below.

supervisor@rtbrick: cfg> show config system platform profile
{
  "rtbrick-config:profile": "nat_1q"
}

Configure Service Profile

Service profile configuration in subscriber management allows to assign QoS configurations to a subscriber.

Configure the service profile to enable QoS. The service profile defined to enable Quality of Service with the profile name is subs-1q-profile.

set access service-profile subs_service qos profile subs-1q-profile
commit

The configuration of the service profile named subs-1q-profile is shown below.

supervisor@rtbrick: cfg> show config access service-profile subs_service
{
  "rtbrick-config:service-profile": [
    {
      "profile-name": "subs_service",
      "qos": {
        "profile": "subs-1q-profile"
      }
    }
  ]
}

Enable QoS on the PPPoE and IPoE subscriber access interface (ifp-0/1/23) to enable QoS for the subscriber.

set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100 service-profile-name subs_service

set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100 serviceprofile-name subs_service
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 serviceprofile-name subs_service
commit

Below is the double-tagged access interface on which the service profile subs_service is configured for access type PPPoE:

supervisor@rtbrick>multiservice-edge.rtbrick.net: cfg> show config access interface double-tagged ifp-0/1/23
{
  "rtbrick-config:double-tagged": [
    {
      "interface-name": "ifp-0/1/23",
      "outer-vlan-min": 1001,
      "outer-vlan-max": 1100,
      "inner-vlan-min": 1001,
      "inner-vlan-max": 1100,
      "access-type": "PPPoE",
      "service-profile-name": "subs_service",
      "aaa-profile-name": "aaa-profile",
      "gateway-ifl": "lo-0/0/1/0"
    }
  ]
}

Below is the double-tagged access interface on which the service profile subs_service is configured for access type IPoE:

supervisor@rtbrick>multiservice-edge.rtbrick.net: cfg> show config access interface double-tagged ifp-0/1/8
{
  "rtbrick-config:double-tagged": [
    {
      "interface-name": "ifp-0/1/8",
      "outer-vlan-min": 1001,
      "outer-vlan-max": 1100,
      "inner-vlan-min": 1001,
      "inner-vlan-max": 1100,
      "access-type": "IPoE",
      "service-profile-name": "subs_service",
      "aaa-profile-name": "aaa-profile",
      "gateway-ifl": "lo-0/0/1/0"
    }
  ]
}

Configure QoS profile to enable on subscriber.

set forwarding-options class-of-service profile subs-1q-profile
set forwarding-options class-of-service profile subs-1q-profile classifier-name subs-1q-classifier
set forwarding-options class-of-service profile subs-1q-profile class-queue-map-name subs-1q-class-queue
set forwarding-options class-of-service profile subs-1q-profile class-policer-map-name subs-1q-class-policer
set forwarding-options class-of-service profile subs-1q-profile policer-name subs-1q-policer
set forwarding-options class-of-service profile subs-1q-profile scheduler-map-name subs-1q-scheduler
commit

The QoS Profile with all the primitives needed to enable traffic profiles on subscribers are as follows:

supervisor@rtbrick: op> show config forwarding-options class-of-service profile subs-1q-profile
{
  "rtbrick-config:profile": [
    {
      "profile-name": "subs-1q-profile",
      "classifier-name": "subs-1q-classifier",
      "class-queue-map-name": "subs-1q-class-queue",
      "class-policer-map-name": "subs-1q-class-policer",
      "policer-name": "subs-1q-policer",
      "scheduler-map-name": "subs-1q-scheduler"
    }
  ]
}

Configure Downstream QoS

Downstream Quality of Service (QoS) is used to prioritize network traffic from the Internet to subscribers.

Enable global classification for downstream traffic.

set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 101
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 101 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 101 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 101 match source-l4-port 60001
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 101 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 101 action forward-class class-0
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 102
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 102 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 102 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 102 match source-l4-port 60002
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 102 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 102 action forward-class class-0
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 103
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 103 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 103 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 103 match source-l4-port 60003
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 103 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 103 action forward-class class-0
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 104
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 104 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 104 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 104 match source-l4-port 60004
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 104 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 104 action forward-class class-0
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 105
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 105 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 105 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 105 match source-l4-port 60005
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 105 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 105 action forward-class class-0
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 106
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 106 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 106 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 106 match source-l4-port 60006
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 106 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 106 action forward-class class-0
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 107
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 107 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 107 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 107 match source-l4-port 60007
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 107 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 107 action forward-class class-0
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 108
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 108 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 108 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 108 match source-l4-port 60008
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 108 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 108 action forward-class class-0
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 109
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 109 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 109 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 109 match source-l4-port 60009
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 109 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 109 action forward-class class-0
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 110
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 110 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 110 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 110 match source-l4-port 60010
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 110 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 110 action forward-class class-0
commit

Below is the multi-field-classifier (MFC) based classifier for global enabling of downstream traffic classification.

supervisor@rtbrick: op> show config forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc
{
  "rtbrick-config:rule": [
    {
      "rule-name": "global_mfc",
      "ordinal": [
        {
          "ordinal-value": 101,
          "match": {
            "source-ipv4-prefix": "192.0.2.2/32",
            "source-l4-port": 60001
          },
          "action": {
            "forward-class": "class-0"
          }
        },
        {
          "ordinal-value": 102,
          "match": {
            "source-ipv4-prefix": "192.0.2.2/32",
            "source-l4-port": 60002
          },
          "action": {
            "forward-class": "class-0"
          }
        },
        {
          "ordinal-value": 103,
          "match": {
            "source-ipv4-prefix": "192.0.2.2/32",
            "source-l4-port": 60003
          },
          "action": {
            "forward-class": "class-0"
          }
        },
        {
          "ordinal-value": 104,
          "match": {
            "source-ipv4-prefix": "192.0.2.2/32",
            "source-l4-port": 60004
          },
          "action": {
            "forward-class": "class-0"
          }
        },
        {
          "ordinal-value": 105,
          "match": {
            "source-ipv4-prefix": "192.0.2.2/32",
            "source-l4-port": 60005
          },
          "action": {
            "forward-class": "class-0"
          }
        },
        {
          "ordinal-value": 106,
          "match": {
            "source-ipv4-prefix": "192.0.2.2/32",
            "source-l4-port": 60006
          },
          "action": {
            "forward-class": "class-0"
          }
        },
        {
          "ordinal-value": 107,
          "match": {
            "source-ipv4-prefix": "192.0.2.2/32",
            "source-l4-port": 60007
          },
          "action": {
            "forward-class": "class-0"
          }
        },
        {
          "ordinal-value": 108,
          "match": {
            "source-ipv4-prefix": "192.0.2.2/32",
            "source-l4-port": 60008
          },
          "action": {
            "forward-class": "class-0"
          }
        },
        {
          "ordinal-value": 109,
          "match": {
            "source-ipv4-prefix": "192.0.2.2/32",
            "source-l4-port": 60009
          },
          "action": {
            "forward-class": "class-0"
          }
        },
        {
          "ordinal-value": 110,
          "match": {
            "source-ipv4-prefix": "192.0.2.2/32",
            "source-l4-port": 60010
          },
          "action": {
            "forward-class": "class-0"
          }
        }
      ]
    }
  ]
}

Configure the queues needed for enqueuing and dequeuing traffic streams.

set forwarding-options class-of-service queue BE_SUBS
set forwarding-options class-of-service queue BE_SUBS queue-size 375000
set forwarding-options class-of-service queue BE_SUBS shaper-name shaper_session
commit

The queue configuration is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service queue
{
  "rtbrick-config:queue": [
    {
      "queue-name": "BE_SUBS",
      "queue-size": 375000,
      "shaper-name": "shaper_session"
    }
  ]
}

Configure downstream traffic shaping for the queue.

Queue Shaping is only on the BE_SUBS1 queue.

set forwarding-options class-of-service shaper shaper_session
set forwarding-options class-of-service shaper shaper_session shaping-rate-high 1000
set forwarding-options class-of-service shaper shaper_session shaping-rate-low 0
commit

The shaping Configuration is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service shaper
{
  "rtbrick-config:shaper": [
    {
      "shaper-name": "shaper_session",
      "shaping-rate-high": 1000,
      "shaping-rate-low": 0
    }
  ]
}

Enqueue classified traffic to a queue using class-to-queue mapping.

set forwarding-options class-of-service class-queue-map subs-1q-class-queue
set forwarding-options class-of-service class-queue-map subs-1q-class-queue class class-0
set forwarding-options class-of-service class-queue-map subs-1q-class-queue class class-0 queue-name BE_SUBS
commit

Class-to-Queue mapping configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service class-queue-map subs-1q-class-queue class
{
  "rtbrick-config:class": [
    {
      "class-type": "class-0",
      "queue-name": "BE_SUBS"
    }
  ]
}

Configure Upstream QoS

Configure the BA Classifier for the classification of multiple traffic streams targeted at PPPoE and IPoE subscribers:

set forwarding-options class-of-service classifier subs-1q-classifier
set forwarding-options class-of-service classifier subs-1q-classifier match-type ieee-802.1
set forwarding-options class-of-service classifier subs-1q-classifier match-type ieee-802.1 codepoint 1
set forwarding-options class-of-service classifier subs-1q-classifier match-type ieee-802.1 codepoint 1 class class-0
set forwarding-options class-of-service classifier subs-1q-classifier match-type ieee-802.1 codepoint 2
set forwarding-options class-of-service classifier subs-1q-classifier match-type ieee-802.1 codepoint 2 class class-0
set forwarding-options class-of-service classifier subs-1q-classifier match-type ieee-802.1 codepoint 3
set forwarding-options class-of-service classifier subs-1q-classifier match-type ieee-802.1 codepoint 3 class class-0
set forwarding-options class-of-service classifier subs-1q-classifier match-type ieee-802.1 codepoint 4
set forwarding-options class-of-service classifier subs-1q-classifier match-type ieee-802.1 codepoint 4 class class-0
commit

The configuration of the QoS BA-based Classifier for the classification of upstream traffic toward the PPPoE Subscriber is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service classifier subs-1q-classifier
{
  "rtbrick-config:classifier": [
    {
      "classifier-name": "subs-1q-classifier",
      "match-type": [
        {
          "match-type": "ieee-802.1",
          "codepoint": [
            {
              "codepoint": 1,
              "class": "class-0"
            },
            {
              "codepoint": 2,
              "class": "class-0"
            },
            {
              "codepoint": 3,
              "class": "class-0"
            },
            {
              "codepoint": 4,
              "class": "class-0"
            }
          ]
        }
      ]
    }
  ]
}

Configure single-level policer to police Level1 traffic.

set forwarding-options class-of-service policer subs-1q-policer
set forwarding-options class-of-service policer subs-1q-policer level1-rates
set forwarding-options class-of-service policer subs-1q-policer level1-rates cir 2000
set forwarding-options class-of-service policer subs-1q-policer level1-rates cbs 1000
set forwarding-options class-of-service policer subs-1q-policer type two-rate-three-color
set forwarding-options class-of-service policer subs-1q-policer mode single-level
commit

The single-level policer configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service policer subs-1q-policer
{
  "rtbrick-config:policer": [
    {
      "policer-name": "subs-1q-policer",
      "level1-rates": {
        "cir": 2000,
        "cbs": 1000
      },
      "type": "two-rate-three-color",
      "mode": "single-level"
    }
  ]
}

Map the classified traffic streams to a single policer level using class-to-policer mapping:

set forwarding-options class-of-service class-policer-map subs-1q-class-policer
set forwarding-options class-of-service class-policer-map subs-1q-class-policer class class-0
set forwarding-options class-of-service class-policer-map subs-1q-class-policer class class-0 policer-level level-1
commit

The class-policer-map configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service class-policer-map subs-1q-class-policer class
{
  "rtbrick-config:class": [
    {
      "class": "class-0",
      "policer-level": "level-1"
    }
  ]
}

Configure FreeRADIUS Server

Installation of FreeRADIUS

FreeRADIUS server can be installed on any Linux OS distribution. For information about installing FreeRADIUS, see Installing the FreeRADIUS Server.

Remove the Unsupported Files

It is necessary to remove echo, ntlm_auth, eap, echo, and mschap files once FreeRadius has been installed, since they are not required by this reference design. To remove these files, enter the following commands:

rm -rf /etc/freeradius/3.0/mods-enabled/echo
rm -rf /etc/freeradius/3.0/mods-enabled/ntlm_auth
rm -rf /etc/freeradius/3.0/mods-enabled/eap
rm -rf /etc/freeradius/3.0/mods-enabled/echo
rm -rf /etc/freeradius/3.0/mods-enabled/mschap

FreeRADIUS User and Group Settings

Using the following commands, you can set the user or group as root.

sed -i 's/User=freerad/User=root/g' /lib/systemd/system/freeradius.service
sed -i 's/Group=freerad/Group=root/g' /lib/systemd/system/freeradius.service

Run the command for reloading 'systemd' after user or group settings:

systemctl daemon-reload

Configure the FreeRADIUS Files

It is necessary to configure the FreeRADIUS files once FreeRadius has been installed. The configuration files can be found under /etc/freeradius/3.0/.

authorize

Using the following command, one can view the authorize file in its default location.

~:/etc/freeradius/3.0 # cat mods-config/files/authorize

Replace the content of the authorize file with the following:

$INCLUDE /etc/freeradius/3.0/ipoe_pppoe_users_file

This file can also be downloaded from the appendix (Appendix C: RADIUS Server Configuration).

ipoe_pppoe_users_file

The IPoE and PPPoE users file (ipoe_pppoe_users_file) mentioned in the above section includes subscriber profile parameters as shown below.

DEFAULT User-Name =~ '^[0-9a-f\:]+@ipoe$', Cleartext-Password := 'ipoe'
    Service-Type = Framed-User,
    Class = "IPOE",
    Reply-Message = "User on CBNG",
    RtBrick-DNS-Primary = 203.0.113.201,
    RtBrick-DNS-Secondary = 203.0.113.202,
    RtBrick-DNS-Primary-IPv6  = 2001:db8:201:1::201,
    RtBrick-DNS-Secondary-IPv6 = 2001:db8:202:1::202,
    Acct-Interim-Interval = 120,
    RtBrick-QoS-Profile = "subs-1q-profile"

DEFAULT User-Name =~ '^[0-9a-f\:]+@pppoe$', Cleartext-Password := 'pppoe'
    Service-Type = Framed-User,
    Class = "PPPOE",
    Reply-Message = "User on CBNG",
    RtBrick-DNS-Primary = 203.0.113.201,
    RtBrick-DNS-Secondary = 203.0.113.202,
    RtBrick-DNS-Primary-IPv6  = 2001:db8:201:1::201,
    RtBrick-DNS-Secondary-IPv6 = 2001:db8:202:1::202,
    Acct-Interim-Interval = 120,
    RtBrick-QoS-Profile = "subs-1q-profile"

The ipoe_pppoe_users_file can be created with the above content in the /etc/freeradius/3.0/ path. Alternatively, this file can be downloaded from the appendix section of this guide and placed at /etc/freeradius/3.0/.

clients.conf

Clients.conf file shall be configured with the expected RADIUS client IP address and secret.

client rtbrick {
        ipaddr          = 192.0.2.74
        secret          = testing123
        shortname       = rtbrick
        nas_type	= other
        require_message_authenticator = no
}

The clients.conf file (/etc/freeradius/3.0/clients.conf) used for this reference design can be downloaded from the appendix section of this guide.

radiusd.conf

The radiusd.conf file should be configured with the expected RADIUS authentication and accounting parameters.

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct
name = freeradius
confdir = ${raddbdir}
modconfdir = ${confdir}/mods-config
run_dir = ${localstatedir}/run/${name}
db_dir = ${raddbdir}
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/${name}.pid
correct_escapes = true
max_request_time = 5
cleanup_delay = 0
max_requests = 16384
hostname_lookups = no
log {
    destination = files
    file = ${logdir}/radius.log
    stripped_names = no
    auth = yes
}
checkrad = ${sbindir}/checkrad
security {
    # user = radius
    # group = radius
    allow_core_dumps = no
    max_attributes = 200
    reject_delay = 0
    status_server = no
@openssl_version_check_config@
}
proxy_requests  = no
$INCLUDE clients.conf
thread pool {
    start_servers = 32
    max_servers = 128
    min_spare_servers = 8
    max_spare_servers = 16
    max_queue_size = 16384
    max_requests_per_server = 0
    auto_limit_acct = no
}
modules {
    $INCLUDE mods-enabled/
}
instantiate {
    files
    linelog
}
server default {
    listen {
        type = auth
        ipaddr = *
        port = 1812
    }
    listen {
        type = acct
        ipaddr = *
        port = 1813
    }
    authorize {
        update request {
            FreeRADIUS-Client-Shortname = "%{&request:Client-Shortname}"
        }
        if (&request:Client-Shortname == "rtbrick-server") {
            rtbrick-server-log
        }
        files
        pap
    }
    authenticate {
        pap
    }
    post-auth {
        if (&request:Client-Shortname == "rtbrick-server") {
            rtbrick-server-log
        }
        Post-Auth-Type REJECT {
            update reply {
                Reply-Message := "Login Failed. Please check your username and password."
            }
            attr_filter.access_reject
        }
    }
    preacct {
        ok
    }
    accounting {
        if (&request:Client-Shortname == "rtbrick-server") {
            rtbrick-server-log
        }
    ok
    }
    session {
    }
}

Radiusd.conf should be configured to use UDP ports 1812 and 1813 for authentication and accounting, respectively. Additionally, rtbrick-server-log should be added to the parameters for authorise, authenticate, and accounting.

The radiusd.conf file (/etc/freeradius/3.0/radiusd.conf) used for this reference design can be downloaded from the appendix section (Appendix C) of this guide.

detail

The detail file shall be configured for the RADIUS accounting logs.

/etc/freeradius/3.0 # cat mods-enabled/detail
    permissions = 0666detail rtbrick-server-log {
    filename = ${radacctdir}/rtbrick-server-detail.log

    header = "%t;%{NAS-IP-Address};%I;%{Packet-Src-Port}"
    log_packet_header = no
}

Ensure that rtbrick-server-log is specified in the detail file.

The detail file (/etc/freeradius/3.0/mods-enabled/detail) used for this reference design can be downloaded from the appendix section (Appendix C) of this guide.

dictionary.rtbrick

Add the RtBrick RADIUS dictionary (dictionary.rtbrick) to /usr/share/freeradius/dictionary.rtbrick and include it in` /usr/share/freeradius/dictionary`.

The dictionary.rtbrick contains the RBFS attributes in FreeRADIUS format.

Click here to download the radius_config.zip, which contains the dictionary.rtbrick file.

Stopping and Starting the FreeRADIUS Server for any Changes

For any changes, stop and restart the FreeRADIUS server.

To stop the server, enter the following command:

sudo service freeradius stop

To start the server, enter the following command:

sudo service freeradius start

The FreeRadius server is now ready to provide AAA (Authentication, Accounting & Authorization) services to logging in subscribers.

Displaying the RADIUS Service Status

Run the following command to determine whether RADIUS service is active:

sudo service freeradius status