PPPoE Subscriber Management Configuration

PPPoE (Point-to-Point Protocol over Ethernet) is a network protocol that provides connectivity across Ethernet networks. The protocol enables communication between network endpoints and service providers implement PPPoE to connect many hosts on a single Ethernet LAN to the core network through a common device. In RBFS, the PPPoE daemon (pppoed) manages PPPoE and PPP sessions.

For PPPoE Subscriber Management, the following configurations are mandatory:

  1. Access Interface Configuration

  2. Access Profile Configuration

  3. AAA (Authentication, Authorization and Accounting) Profile Configuration. Based on the authentication requirement, configure any one of the following:

    1. Local Authentication

      1. Pool Configuration

      2. User Profile Configuration

    2. RADIUS Authentication

      1. RADIUS Profile Configuration

      2. RADIUS Server Configuration

This solution section discusses RADIUS authentication.

NOTES:

  • Access interfaces can be configured without VLAN tags (untagged) and with one (single tagged) or two (double tagged) VLAN tags.

  • There can be more than one interface configured for subscriber management and each interface can reference the same profile.

Configuring PPPoE Subscriber Management

For detailed information about the subscriber configuration options, see the Subscriber Management Configuration Guide.

  1. Configure the access profile pppoe.

set access access-profile pppoe
set access access-profile pppoe instance default
set access access-profile pppoe protocol pppoe enable true
set access access-profile pppoe protocol ppp lcp authentication-protocol PAP
set access access-profile pppoe protocol ppp lcp echo-interval 30
set access access-profile pppoe protocol ppp lcp echo-enable true
set access access-profile pppoe protocol ppp ipcp enable true
set access access-profile pppoe protocol ppp ipcp source-ifl lo-0/0/1/0
set access access-profile pppoe protocol ppp ip6cp enable true
set access access-profile pppoe protocol ra enable true
set access access-profile pppoe protocol ra interval 30
set access access-profile pppoe protocol dhcpv6 enable true
set access access-profile pppoe protocol dhcpv6 lifetime 14400
set access access-profile pppoe protocol dhcpv6 preferred-lifetime 1800
set access access-profile pppoe address-family ipv4 enable true
set access access-profile pppoe address-family ipv4 pool-name poolv4
set access access-profile pppoe address-family ipv4 primary-dns 203.0.113.200
set access access-profile pppoe address-family ipv4 secondary-dns 203.0.113.201
set access access-profile pppoe address-family ipv6 enable true
set access access-profile pppoe address-family ipv6 pool-name poolv6
set access access-profile pppoe address-family ipv6 prefix-delegation-pool-name poolv6pd
set access access-profile pppoe address-family ipv6 primary-dns 2001:db8:0:20::1
set access access-profile pppoe address-family ipv6 secondary-dns 2001:db8:0:20::1
commit

The access profile configuration is shown below.

supervisor@rtbrick: op> show config access access-profile
{
  "rtbrick-config:access-profile": [
    {
      "profile-name": "pppoe",
      "instance": "default",
      "protocol": {
        "pppoe": {
          "enable": "true"
        },
        "ppp": {
          "lcp": {
            "authentication-protocol": "PAP",
            "echo-interval": 30,
            "echo-enable": "true"
          },
          "ipcp": {
            "enable": "true",
            "source-ifl": "lo-0/0/1/0"
          },
          "ip6cp": {
            "enable": "true"
          }
        },
        "ra": {
          "enable": "true",
          "interval": 30
        },
        "dhcpv6": {
          "enable": "true",
          "lifetime": 14400,
          "preferred-lifetime": 1800
        }
      },
      "address-family": {
        "ipv4": {
          "enable": "true",
          "pool-name": "poolv4",
          "primary-dns": "203.0.113.200",
          "secondary-dns": "203.0.113.201"
        },
        "ipv6": {
          "enable": "true",
          "pool-name": "poolv6",
          "prefix-delegation-pool-name": "poolv6pd",
          "primary-dns": "2001:db8:0:20::1",
          "secondary-dns": "2001:db8:0:20::1"
        }
      }
    }
  ]
}

  1. Configure the Authentication and Accounting (AAA) profile for aaa-profile.

set access aaa-profile aaa-profile
set access aaa-profile aaa-profile session-timeout 0
set access aaa-profile aaa-profile idle-timeout 0
set access aaa-profile aaa-profile aaa-radius-profile radius-profile
set access aaa-profile aaa-profile authentication order RADIUS
set access aaa-profile aaa-profile accounting order RADIUS
set access aaa-profile aaa-profile accounting interim-interval 86400
set access aaa-profile aaa-profile accounting ingress accounting-source POLICER
set access aaa-profile aaa-profile accounting egress accounting-source CLASS
commit

The access AAA configuration is shown below.

supervisor@rtbrick: op> show config access aaa-profile
{
  "rtbrick-config:aaa-profile": [
    {
      "profile-name": "aaa-profile",
      "session-timeout": 0,
      "idle-timeout": 0,
      "aaa-radius-profile": "radius-profile",
      "authentication": {
        "order": "RADIUS"
      },
      "accounting": {
        "order": "RADIUS",
        "interim-interval": 86400,
        "ingress": {
          "accounting-source": "POLICER"
        },
        "egress": {
          "accounting-source": "CLASS"
        }
      }
    }
  ]
}

  1. Configure the access interface. Double-tagged interface is configured in this case as the access interface (ifp-0/1/16). The interface configuration assigns the access type, access profile, AAA profile, and further optional attributes like service-profile to the specified access interface.

set access interface double-tagged ifp-0/1/16 1001 1100 1001 1100
set access interface double-tagged ifp-0/1/16 1001 1100 1001 1100 access-type PPPoE
set access interface double-tagged ifp-0/1/16 1001 1100 1001 1100 access-profile-name pppoe
set access interface double-tagged ifp-0/1/16 1001 1100 1001 1100 service-profile-name qos_service
set access interface double-tagged ifp-0/1/16 1001 1100 1001 1100 aaa-profile-name aaa-profile
commit

The double-tagged access interface configuration is shown below.

supervisor@rtbrick: op> show config access interface
{
  "rtbrick-config:interface": {
    "double-tagged": [
      {
        "interface-name": "ifp-0/1/16",
        "outer-vlan-min": 1001,
        "outer-vlan-max": 1100,
        "inner-vlan-min": 1001,
        "inner-vlan-max": 1100,
        "access-type": "PPPoE",
        "access-profile-name": "pppoe",
        "service-profile-name": "qos_service",
        "aaa-profile-name": "aaa-profile",
        "gateway-ifl": "lo-0/0/1/0"
      }
    ]
  }
}

  1. In this solution, we configure AAA authentication and accounting with RADIUS. To use RADIUS authentication and accounting both the RADIUS profile and RADIUS server configurations (see below) must be configured.

  1. Configure RADIUS profile radius-profile.

set access radius-profile radius-profile
set access radius-profile radius-profile nas-ip-address 192.0.2.74
set access radius-profile radius-profile nas-port-format DEFAULT
set access radius-profile radius-profile nas-port-type Ethernet
set access radius-profile radius-profile authentication radius-server-profile-name radius
set access radius-profile radius-profile accounting radius-server-profile-name radius
commit

The RADIUS profile configuration is shown below.

supervisor@rtbrick: op> show config access radius-profile radius-profile
{
  "rtbrick-config:radius-profile": [
    {
      "profile-name": "radius-profile",
      "nas-ip-address": "192.0.2.74",
      "nas-port-format": "DEFAULT",
      "nas-port-type": "Ethernet",
      "authentication": {
        "radius-server-profile-name": [
          "radius"
          ]
      },
      "accounting": {
        "radius-server-profile-name": [
          "radius"
          ]
      }
    }
  ]
}

  1. Configure the RADIUS server radius.

set access radius-server radius
set access radius-server radius address 192.0.2.34
set access radius-server radius source-address 192.0.2.74
set access radius-server radius secret-encrypted-text $2b2feb12f730107454b1be6a0f8242b0f
set access radius-server radius routing-instance default
set access radius-server radius rate 300
set access radius-server radius authentication enable true
set access radius-server radius authentication retry 3
set access radius-server radius authentication timeout 5
set access radius-server radius accounting enable true
set access radius-server radius accounting timeout 30
set access radius-server radius coa enable true
commit
The attribute secret-plain-text is converted to secret-encrypted-text in the show command output and the value is hashed.

The RADIUS server configuration is shown below.

supervisor@rtbrick: op> show config access radius-server radius
{
  "rtbrick-config:radius-server": [
    {
      "server-name": "radius",
      "address": "192.0.2.34",
      "source-address": "192.0.2.74",
      "secret-encrypted-text": "$2b2feb12f730107454b1be6a0f8242b0f",
      "routing-instance": "default",
      "rate": 300,
      "authentication": {
        "enable": "true",
        "retry": 3,
        "timeout": 5
      },
      "accounting": {
        "enable": "true",
        "timeout": 30
      },
      "coa": {
        "enable": "true"
      }
    }
  ]
}

  1. Configure the IPv4 and IPv6 access pools.

set access pool poolv4
set access pool poolv4 ipv4-address low 203.0.113.1
set access pool poolv4 ipv4-address high 203.0.113.64
set access pool poolv6
set access pool poolv6 ipv6-prefix low 2001:db8:0:1::/64
set access pool poolv6 ipv6-prefix high 2001:db8:0:2::/64
set access pool poolv6pd
set access pool poolv6pd ipv6-prefix low 2001:db8:0:3::/64
set access pool poolv6pd ipv6-prefix high 2001:db8:0:4::/64
commit

The access pool configuration is shown below.

supervisor@rtbrick: op> show config access pool
{
  "rtbrick-config:pool": [
    {
      "pool-name": "poolv4",
      "ipv4-address": {
        "low": "203.0.113.1",
        "high": "203.0.113.64"
      }
    },
    {
      "pool-name": "poolv6",
      "ipv6-prefix": {
        "low": "2001:db8:0:1::/64",
        "high": "2001:db8:0:2::/64"
      }
    },
    {
      "pool-name": "poolv6pd",
      "ipv6-prefix": {
        "low": "2001:db8:0:3::/64",
        "high": "2001:db8:0:4::/64"
      }
    }
  ]
}

PPPoE Quality of Service (QoS) Configuration

The QoS model explained in this document uses a complex HQoS model with the intent to showcase the complete range of QoS features available in RBFS. However, it may not be needed or desirable for all deployments. In such a case it should be possible to conceive of a simple QoS model as required by simplifying the provided QoS model.

Following are the steps involved in configuring and verifying PPPoE QoS:

  1. Configuring service profile to enable QoS on PPPoE subscriber

  2. Configuring downstream QoS

  3. Configuring upstream QoS

  4. Configuring QoS remarking

  5. Configuring PPPoE subscriber accounting for upstream and downstream traffic

  6. Configuring PPPoE subscribers QoS on BNG Blaster

  7. Validating PPPoE QoS on BNG Blaster

The figure below shows how QoS is configured for ingress and egress traffic.

qos design
Figure 1. Hierarchical Quality of Service Primitives

For detailed information about the QoS configuration options, see HQoS Configuration Guide.

Configure Service Profile

Service profile configuration in subscriber management allows to assign QoS configurations to a subscriber.

  1. Configure the service profile to enable QoS. The service profile defined to enable Quality of Service with the profile name is subs-4q-profile.

set access service-profile qos_service qos profile subs-4q-profile
commit

The configuration of the service profile named subs-4q-profile is shown below.

supervisor@rtbrick: op> show config access service-profile qos_service
{
  "rtbrick-config:service-profile": [
    {
      "profile-name": "qos_service",
      "qos": {
        "profile": "subs-4q-profile"
      }
    }
  ]
}

  1. Enable QoS on PPPoE subscriber access interface (ifp-0/1/16) to enable QoS for PPPoE subscriber.

set access interface double-tagged ifp-0/1/16 1001 1100 1001 1100 service-profile-name qos_service
commit

Below is the double-tagged access interface on which the service profile qos_service is configured.

supervisor@rtbrick: op> show config access interface double-tagged
{
  "rtbrick-config:double-tagged": [
    {
      "interface-name": "ifp-0/1/16",
      "outer-vlan-min": 1001,
      "outer-vlan-max": 1100,
      "inner-vlan-min": 1001,
      "inner-vlan-max": 1100,
      "access-type": "PPPoE",
      "access-profile-name": "pppoe",
      "service-profile-name": "qos_service",
      "aaa-profile-name": "aaa-profile",
      "gateway-ifl": "lo-0/0/1/0"
    }
  ]
}

  1. Configure QoS profile to enable on PPPoE subscriber.

set forwarding-options class-of-service profile subs-4q-profile
set forwarding-options class-of-service profile subs-4q-profile classifier-name subs-4q-classifier
set forwarding-options class-of-service profile subs-4q-profile class-queue-map-name subs-4q-class-queue
set forwarding-options class-of-service profile subs-4q-profile remark-map-name subs-4q-remark
set forwarding-options class-of-service profile subs-4q-profile class-policer-map-name subs-4q-class-policer
set forwarding-options class-of-service profile subs-4q-profile policer-name subs-4q-policer
set forwarding-options class-of-service profile subs-4q-profile scheduler-map-name subs-4q-scheduler
commit

The QoS Profile with all the primitives needed to enable traffic profiles on PPPoE Subscribers is as follows:

supervisor@rtbrick: op> show config forwarding-options class-of-service profile subs-4q-profile
{
  "rtbrick-config:profile": [
    {
      "profile-name": "subs-4q-profile",
      "classifier-name": "subs-4q-classifier",
      "class-queue-map-name": "subs-4q-class-queue",
      "remark-map-name": "subs-4q-remark",
      "class-policer-map-name": "subs-4q-class-policer",
      "policer-name": "subs-4q-policer",
      "scheduler-map-name": "subs-4q-scheduler"
    }
  ]
}

Configure Downstream QoS

Downstream Quality of Service (QoS) is used to prioritize network traffic from the Internet to subscribers.

  1. Enable global classification for downstream traffic.

set forwarding-options class-of-service global multifield-classifier-name global_mfc
commit

Below is the multi-field-classifier (MFC) based classifier for global enabling of downstream traffic classification.

supervisor@rtbrick: op> show config forwarding-options class-of-service global multifield-classifier-name
{
  "rtbrick-config:multifield-classifier-name": "global_mfc"
}

  1. Configure the MFC-based classifier with qualifiers and actions.

set forwarding-options class-of-service multifield-classifier acl l3v4
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001 match ipv4-tos 128
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001 action forward-class class-0
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002 match ipv4-tos 160
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002 action forward-class class-1
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003 match ipv4-tos 192
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003 action forward-class class-2
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004 match ipv4-tos 224
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004 match source-ipv4-prefix 192.0.2.2/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004 action forward-class class-3
commit

The configuration of the QoS MFC-based Classifier for the classification of downstream traffic from the core towards PPPoE Subscriber is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc
{
  "rtbrick-config:rule": [
    {
      "rule-name": "global_mfc",
      "ordinal": [
        {
          "ordinal-value": 1001,
          "match": {
            "ipv4-tos": 128,
            "source-ipv4-prefix": "192.0.2.2/32"
          },
          "action": {
            "forward-class": "class-0"
          }
        },
        {
          "ordinal-value": 1002,
          "match": {
            "ipv4-tos": 160,
            "source-ipv4-prefix": "192.0.2.2/32"
          },
          "action": {
            "forward-class": "class-1"
          }
        },
        {
          "ordinal-value": 1003,
          "match": {
            "ipv4-tos": 192,
            "source-ipv4-prefix": "192.0.2.2/32"
          },
          "action": {
            "forward-class": "class-2"
          }
        },
        {
          "ordinal-value": 1004,
          "match": {
            "ipv4-tos": 224,
            "source-ipv4-prefix": "192.0.2.2/32"
          },
          "action": {
            "forward-class": "class-3"
          }
        }
      ]
    }
  ]
}

  1. Enqueue classified traffic to different queues using class-to-queue mapping.

set forwarding-options class-of-service queue-group subs-4q-class-queue queue-numbers 4
set forwarding-options class-of-service class-queue-map subs-4q-class-queue
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-0
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-0 queue-name BE_SUBS
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-1
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-1 queue-name LD_SUBS
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-2
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-2 queue-name LL_SUBS
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-3
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-3 queue-name VO_SUBS
commit

Below is the QoS class-queue mapping configuration:

supervisor@rtbrick: op> show config forwarding-options class-of-service class-queue-map subs-4q-class-queue class
{
  "rtbrick-config:class": [
    {
      "class-type": "class-0",
      "queue-name": "BE_SUBS"
    },
    {
      "class-type": "class-1",
      "queue-name": "LD_SUBS"
    },
    {
      "class-type": "class-2",
      "queue-name": "LL_SUBS"
    },
    {
      "class-type": "class-3",
      "queue-name": "VO_SUBS"
    }
  ]
}

  1. Configure the queues needed for enqueuing and dequeuing traffic streams.

set forwarding-options class-of-service queue BE_SUBS
set forwarding-options class-of-service queue BE_SUBS queue-size 375000
set forwarding-options class-of-service queue LD_SUBS
set forwarding-options class-of-service queue LD_SUBS queue-size 625000
set forwarding-options class-of-service queue LL_SUBS
set forwarding-options class-of-service queue LL_SUBS queue-size 625000
set forwarding-options class-of-service queue VO_SUBS
set forwarding-options class-of-service queue VO_SUBS queue-size 156250
set forwarding-options class-of-service queue VO_SUBS shaper-name shaper_VO
commit

The queue Configuration is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service queue
{
  "rtbrick-config:queue": [
    {
      "queue-name": "BE_SUBS",
      "queue-size": 375000
    },
    {
      "queue-name": "LD_SUBS",
      "queue-size": 625000
    },
    {
      "queue-name": "LL_SUBS",
      "queue-size": 625000
    },
    {
      "queue-name": "VO_SUBS",
      "queue-size": 156250,
      "shaper-name": "shaper_VO"
    }
  ]
}

  1. Configure the scheduler needed by Subscriber/Session scheduler-map and OLT scheduler-map.

set forwarding-options class-of-service scheduler pon0
set forwarding-options class-of-service scheduler pon0 type fair_queueing
set forwarding-options class-of-service scheduler subs-4q-class-queue
set forwarding-options class-of-service scheduler subs-4q-class-queue shaper-name shaper_session
set forwarding-options class-of-service scheduler subs-4q-class-queue type strict_priority
commit

The configuration of the scheduler-map and OLT scheduler-map is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service scheduler
{
  "rtbrick-config:scheduler": [
    {
      "scheduler-name": "pon0",
      "type": "fair_queueing"
    },
    {
      "scheduler-name": "subs-4q-class-queue",
      "shaper-name": "shaper_session",
      "type": "strict_priority"
    }
  ]
}

  1. Configure the session/subscriber scheduler mapping for dequeuing traffic based on scheduler type for each queue:

set forwarding-options class-of-service scheduler-map schedmap-olt
set forwarding-options class-of-service scheduler-map schedmap-olt scheduler-name pon0
set forwarding-options class-of-service scheduler-map schedmap-olt scheduler-name pon0 port-connection scheduler_to_port
set forwarding-options class-of-service scheduler-map subs-4q-scheduler
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name BE_SUBS
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name BE_SUBS parent-flow high-flow
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name BE_SUBS parent-scheduler-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name BE_SUBS connection-point strict_priority_3
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LD_SUBS
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LD_SUBS parent-flow high-flow
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LD_SUBS parent-scheduler-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LD_SUBS connection-point strict_priority_1
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LL_SUBS
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LL_SUBS parent-flow high-flow
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LL_SUBS parent-scheduler-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LL_SUBS connection-point strict_priority_2
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name VO_SUBS
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name VO_SUBS parent-flow high-flow
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name VO_SUBS parent-scheduler-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name VO_SUBS connection-point strict_priority_0
set forwarding-options class-of-service scheduler-map subs-4q-scheduler scheduler-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler scheduler-name subs-4q-class-queue port-connection scheduler_to_port
commit

The QoS Subscriber/Session Scheduler-Map configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service scheduler-map subs-4q-scheduler
{
  "rtbrick-config:scheduler-map": [
    {
      "scheduler-map-name": "subs-4q-scheduler",
      "queue-group-name": [
        {
          "group-name": "subs-4q-class-queue",
          "queue-name": [
            {
              "name": "BE_SUBS",
              "parent-flow": "high-flow",
              "parent-scheduler-name": "subs-4q-class-queue",
              "connection-point": "strict_priority_3"
            },
            {
              "name": "LD_SUBS",
              "parent-flow": "high-flow",
              "parent-scheduler-name": "subs-4q-class-queue",
              "connection-point": "strict_priority_1"
            },
            {
              "name": "LL_SUBS",
              "parent-flow": "high-flow",
              "parent-scheduler-name": "subs-4q-class-queue",
              "connection-point": "strict_priority_2"
            },
            {
              "name": "VO_SUBS",
              "parent-flow": "high-flow",
              "parent-scheduler-name": "subs-4q-class-queue",
              "connection-point": "strict_priority_0"
            }
          ]
        }
      ],
      "scheduler-name": [
        {
          "name": "subs-4q-class-queue",
          "port-connection": "scheduler_to_port"
        }
      ]
    }
  ]
}

  1. Configure the OLT scheduler-mapping for each PON to be scheduled according to the scheduler type.

set forwarding-options class-of-service scheduler-map schedmap-olt
set forwarding-options class-of-service scheduler-map schedmap-olt scheduler-name pon0
set forwarding-options class-of-service scheduler-map schedmap-olt scheduler-name pon0 port-connection scheduler_to_port
commit

The OLT Scheduler-Map configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service scheduler-map schedmap-olt
{
  "rtbrick-config:scheduler-map": [
    {
      "scheduler-map-name": "schedmap-olt",
      "scheduler-name": [
        {
          "name": "pon0",
          "port-connection": "scheduler_to_port"
        }
      ]
    }
  ]
}

  1. Configure downstream traffic shaping for both session schedulers and queues.

Queue Shaping is only on VO_SUBS Queue. 
set forwarding-options class-of-service shaper shaper_VO
set forwarding-options class-of-service shaper shaper_VO shaping-rate-high 2000
set forwarding-options class-of-service shaper shaper_VO shaping-rate-low 0
set forwarding-options class-of-service shaper shaper_session
set forwarding-options class-of-service shaper shaper_session shaping-rate-high 10000
set forwarding-options class-of-service shaper shaper_session shaping-rate-low 100
commit

The shaping Configuration is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service shaper
{
  "rtbrick-config:shaper": [
    {
      "shaper-name": "shaper_VO",
      "shaping-rate-high": 2000,
      "shaping-rate-low": 0
    },
    {
      "shaper-name": "shaper_session",
      "shaping-rate-high": 10000,
      "shaping-rate-low": 100
    }
  ]
}

Configure Upstream QoS

  1. Configure the BA Classifier for the classification of multiple traffic streams targeted at PPPoE subscribers:

set forwarding-options class-of-service classifier subs-4q-classifier
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1 class class-0
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1 remark-codepoint 7
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2 class class-1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2 remark-codepoint 7
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3 class class-2
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3 remark-codepoint 7
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4 class class-3
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4 remark-codepoint 7
commit

The configuration of the QoS BA-based Classifier for the classification of upstream traffic toward the PPPoE Subscriber is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service classifier subs-4q-classifier
{
  "rtbrick-config:classifier": [
    {
      "classifier-name": "subs-4q-classifier",
      "match-type": [
        {
          "match-type": "ieee-802.1",
          "codepoint": [
            {
              "codepoint": 1,
              "class": "class-0",
              "remark-codepoint": 7
            },
            {
              "codepoint": 2,
              "class": "class-1",
              "remark-codepoint": 7
            },
            {
              "codepoint": 3,
              "class": "class-2",
              "remark-codepoint": 7
            },
            {
              "codepoint": 4,
              "class": "class-3",
              "remark-codepoint": 7
            }
          ]
        }
      ]
    }
  ]
}
supervisor@rtbrick: op> show config forwarding-options class-of-service classifier subs-4q-classifier
{
  "rtbrick-config:classifier": [
    {
      "classifier-name": "subs-4q-classifier",
      "match-type": [
        {
          "match-type": "ieee-802.1",
          "codepoint": [
            {
              "codepoint": 1,
              "class": "class-0",
              "remark-codepoint": 7
            },
            {
              "codepoint": 2,
              "class": "class-1",
              "remark-codepoint": 7
            },
            {
              "codepoint": 3,
              "class": "class-2",
              "remark-codepoint": 7
            },
            {
              "codepoint": 4,
              "class": "class-3",
              "remark-codepoint": 7
            }
          ]
        }
      ]
    }
  ]
}

  1. Configure multi-level policer to police 4-Level traffic.

set forwarding-options class-of-service policer subs-4q-policer
set forwarding-options class-of-service policer subs-4q-policer level1-rates
set forwarding-options class-of-service policer subs-4q-policer level1-rates cir 2000
set forwarding-options class-of-service policer subs-4q-policer level1-rates cbs 1000
set forwarding-options class-of-service policer subs-4q-policer level2-rates
set forwarding-options class-of-service policer subs-4q-policer level2-rates cir 3000
set forwarding-options class-of-service policer subs-4q-policer level2-rates cbs 1000
set forwarding-options class-of-service policer subs-4q-policer level3-rates
set forwarding-options class-of-service policer subs-4q-policer level3-rates cir 4000
set forwarding-options class-of-service policer subs-4q-policer level3-rates cbs 1000
set forwarding-options class-of-service policer subs-4q-policer level4-rates
set forwarding-options class-of-service policer subs-4q-policer level4-rates cir 1000
set forwarding-options class-of-service policer subs-4q-policer level4-rates cbs 1000
set forwarding-options class-of-service policer subs-4q-policer levels 4
set forwarding-options class-of-service policer subs-4q-policer type two-rate-three-color
commit

The multi-level policer configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service policer subs-4q-policer
{
  "rtbrick-config:policer": [
    {
      "policer-name": "subs-4q-policer",
      "level1-rates": {
        "cir": 2000,
        "cbs": 1000
      },
      "level2-rates": {
        "cir": 3000,
        "cbs": 1000
      },
      "level3-rates": {
        "cir": 4000,
        "cbs": 1000
      },
      "level4-rates": {
        "cir": 1000,
        "cbs": 1000
      },
      "levels": 4,
      "type": "two-rate-three-color"
    }
  ]
}

  1. Map the classified traffic streams to different policer levels using class-to-policer mapping:

set forwarding-options class-of-service class-policer-map subs-4q-class-policer
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-0
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-0 policer-level level-1
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-1
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-1 policer-level level-2
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-2
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-2 policer-level level-3
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-3
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-3 policer-level level-4
commit

The class-policer-map configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service class-policer-map subs-4q-class-policer class
{
  "rtbrick-config:class": [
    {
      "class": "class-0",
      "policer-level": "level-1"
    },
    {
      "class": "class-1",
      "policer-level": "level-2"
    },
    {
      "class": "class-2",
      "policer-level": "level-3"
    },
    {
      "class": "class-3",
      "policer-level": "level-4"
    }
  ]
}

Configure QoS Remarking

  1. Remark downstream traffic egressing from subscriber interface (egress remarking).

set forwarding-options class-of-service remark-map subs-4q-remark
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 128
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 128 color all
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 128 color all remark-codepoint 6
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 160
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 160 color all
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 160 color all remark-codepoint 6
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 192
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 192 color all
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 192 color all remark-codepoint 6
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 224
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 224 color all
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 224 color all remark-codepoint 6
commit

The remarking configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service remark-map subs-4q-remark
{
  "rtbrick-config:remark-map": [
    {
      "remark-map-name": "subs-4q-remark",
      "remark-type": [
        {
          "remark-type": "ieee-802.1",
          "match-codepoint": [
            {
              "match-codepoint": 128,
              "color": [
                {
                  "color": "all",
                  "remark-codepoint": 6
                }
              ]
            },
            {
              "match-codepoint": 160,
              "color": [
                {
                  "color": "all",
                  "remark-codepoint": 6
                }
              ]
            },
            {
              "match-codepoint": 192,
              "color": [
                {
                  "color": "all",
                  "remark-codepoint": 6
                }
              ]
            },
            {
              "match-codepoint": 224,
              "color": [
                {
                  "color": "all",
                  "remark-codepoint": 6
                }
              ]
            }
          ]
        }
      ]
    }
  ]
}

  1. Remark upstream traffic ingressing to a subscriber’s interface [ingress remarking]

In the upstream traffic classifier configuration shown below, remarking of all traffic streams with code point '7' is done. 
set forwarding-options class-of-service classifier subs-4q-classifier
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1 class class-0
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1 remark-codepoint 7
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2 class class-1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2 remark-codepoint 7
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3 class class-2
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3 remark-codepoint 7
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4 class class-3
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4 remark-codepoint 7
commit

Below is the remarking configuration:

supervisor@rtbrick: op> show config forwarding-options class-of-service classifier subs-4q-classifier
{
  "rtbrick-config:classifier": [
    {
      "classifier-name": "subs-4q-classifier",
      "match-type": [
        {
          "match-type": "ieee-802.1",
          "codepoint": [
            {
              "codepoint": 1,
              "class": "class-0",
              "remark-codepoint": 7
            },
            {
              "codepoint": 2,
              "class": "class-1",
              "remark-codepoint": 7
            },
            {
              "codepoint": 3,
              "class": "class-2",
              "remark-codepoint": 7
            },
            {
              "codepoint": 4,
              "class": "class-3",
              "remark-codepoint": 7
            }
          ]
        }
      ]
    }
  ]
}
supervisor@rtbrick: op> show config forwarding-options class-of-service classifier subs-4q-classifier
{
  "rtbrick-config:classifier": [
    {
      "classifier-name": "subs-4q-classifier",
      "match-type": [
        {
          "match-type": "ieee-802.1",
          "codepoint": [
            {
              "codepoint": 1,
              "class": "class-0",
              "remark-codepoint": 7
            },
            {
              "codepoint": 2,
              "class": "class-1",
              "remark-codepoint": 7
            },
            {
              "codepoint": 3,
              "class": "class-2",
              "remark-codepoint": 7
            },
            {
              "codepoint": 4,
              "class": "class-3",
              "remark-codepoint": 7
            }
          ]
        }
      ]
    }
  ]
}

Configure Mirroring for Downstream Traffic Remark Validation

Ensure that mirroring is removed immediately after the validation is complete to avoid any outages.

Configure Mirroring for Downstream Traffic

set forwarding-options mirror m1
set forwarding-options mirror m1 destination interface cpu-0/0/200
set forwarding-options mirror m1 source direction egress
set forwarding-options mirror m1 source interface ifp-0/1/16
commit

Validate the downstream traffic remarking

This validation requires mirroring the subscriber access interface on the Multiservice Edge device. 
supervisor@rtbrick: op> show config forwarding-options mirror
{
  "rtbrick-config:mirror": [
    {
      "name": "m1",
      "destination": {
        "interface": "cpu-0/0/200"
      },
      "source": {
        "direction": "egress",
        "interface": "ifp-0/1/16"
      }
    }
  ]
}

The capture mirroring can be performed as shown below.

supervisor@rtbrick: op> capture mirror | head -n 10
Success : Mirror capture started

2026-08-21T08:36:32.150804+0000 e8:c5:7a:8f:78:23 > 02:00:00:00:00:01, ethertype 802.1Q (0x8100), length 1030: vlan 1001, p 6, ethertype 802.1Q (0x8100), vlan 1001, p 6, ethertype PPPoE S (0x8864), PPPoE  [ses 0x1] IP (0x0021), length 1002: (tos 0xa0, ttl 63, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    192.0.2.2.65056 > 203.0.113.1.65056: UDP, length 972

2026-08-21T08:36:32.150896+0000 e8:c5:7a:8f:78:23 > 02:00:00:00:00:01, ethertype 802.1Q (0x8100), length 1030: vlan 1001, p 6, ethertype 802.1Q (0x8100), vlan 1001, p 6, ethertype PPPoE S (0x8864), PPPoE  [ses 0x1] IP (0x0021), length 1002: (tos 0xa0, ttl 63, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    192.0.2.2.65056 > 203.0.113.1.65056: UDP, length 972

2026-08-21T08:36:32.150937+0000 e8:c5:7a:8f:78:23 > 02:00:00:00:00:01, ethertype 802.1Q (0x8100), length 1030: vlan 1001, p 6, ethertype 802.1Q (0x8100), vlan 1001, p 6, ethertype PPPoE S (0x8864), PPPoE  [ses 0x1] IP (0x0021), length 1002: (tos 0xa0, ttl 63, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    192.0.2.2.65056 > 203.0.113.1.65056: UDP, length 972

Configure Mirroring for Upstream Traffic Remark Validation

set forwarding-options mirror m1
set forwarding-options mirror m1 destination interface cpu-0/0/200
set forwarding-options mirror m1 source direction egress
set forwarding-options mirror m1 source interface ifp-0/1/16
commit

Validating the upstream traffic remarking

Mirror the core-facing port on the Multiservice Edge device as shown below. 
supervisor@rtbrick: op> show config forwarding-options mirror
{
  "rtbrick-config:mirror": [
    {
      "name": "m1",
      "destination": {
        "interface": "cpu-0/0/200"
      },
      "source": {
        "direction": "ingress",
        "interface": "ifp-0/1/16"
      }
    }
  ]
}

The capture mirroring can be performed as shown below. It confirms all four traffic streams noted with codepoint=7.

supervisor@rtbrick: op> capture mirror | head -n 10
Success : Mirror capture started

2026-08-21T08:36:38.411544+0000 02:00:00:00:00:01 > e8:c5:7a:8f:78:23, ethertype 802.1Q (0x8100), length 1030: vlan 1001, p 2, ethertype 802.1Q (0x8100), vlan 1001, p 2, ethertype PPPoE S (0x8864), PPPoE  [ses 0x1] IP (0x0021), length 1002: (tos 0xa0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    203.0.113.1.65056 > 192.0.2.2.65056: UDP, length 972

2026-08-21T08:36:38.411674+0000 02:00:00:00:00:01 > e8:c5:7a:8f:78:23, ethertype 802.1Q (0x8100), length 1030: vlan 1001, p 4, ethertype 802.1Q (0x8100), vlan 1001, p 4, ethertype PPPoE S (0x8864), PPPoE  [ses 0x1] IP (0x0021), length 1002: (tos 0xe0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    203.0.113.1.65056 > 192.0.2.2.65056: UDP, length 972

2026-08-21T08:36:38.411751+0000 02:00:00:00:00:01 > e8:c5:7a:8f:78:23, ethertype 802.1Q (0x8100), length 1030: vlan 1001, p 3, ethertype 802.1Q (0x8100), vlan 1001, p 3, ethertype PPPoE S (0x8864), PPPoE  [ses 0x1] IP (0x0021), length 1002: (tos 0xc0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    203.0.113.1.65056 > 192.0.2.2.65056: UDP, length 972

Unconfigure Mirroring for Upstream and Downstream Traffic Remark Validation

delete forwarding-options mirror m1
delete forwarding-options mirror m1 destination interface cpu-0/0/200
delete forwarding-options mirror m1 source direction egress
delete forwarding-options mirror m1 source interface ifp-0/1/16
commit

Configure FreeRADIUS Server

Installation of FreeRADIUS

FreeRADIUS server can be installed on any Linux OS distribution. For information about installing FreeRADIUS, see Installing the FreeRADIUS Server.

Remove the Unsupported Files

It is necessary to remove echo, ntlm_auth, eap, echo, and mschap files once FreeRadius has been installed, since they are not required by this reference design. To remove these files, enter the following commands:

rm -rf /etc/freeradius/3.0/mods-enabled/echo
rm -rf /etc/freeradius/3.0/mods-enabled/ntlm_auth
rm -rf /etc/freeradius/3.0/mods-enabled/eap
rm -rf /etc/freeradius/3.0/mods-enabled/echo
rm -rf /etc/freeradius/3.0/mods-enabled/mschap

FreeRADIUS User and Group Settings

Using the following commands, one can set the user or group as root.

sed -i 's/User=freerad/User=root/g' /lib/systemd/system/freeradius.service
sed -i 's/Group=freerad/Group=root/g' /lib/systemd/system/freeradius.service

Run the command for reloading 'systemd' after user or group settings:

systemctl daemon-reload

Configure the FreeRADIUS Files

It is necessary to configure the FreeRADIUS files once FreeRadius has been installed. The configuration files can be found under /etc/freeradius/3.0/.

authorize

Using the following command, one can view the authorize file in its default location.

~:/etc/freeradius/3.0 # cat mods-config/files/authorize

Replace the content of the authorize file with the following:

$INCLUDE /etc/freeradius/3.0/pppoe_users_file
This file can also be downloaded from the appendix (Appendix C: RADIUS Server Configuration).

pppoe_users_file

The PPPoE Users file (pppoe_users_file) mentioned in the above section includes subscriber profile parameters as shown below.

"02:00:00:00:00:01@pppoe" Cleartext-Password := "pppoe"
    Service-Type = Framed-User,
    Framed-Protocol = PPP,
    Class = "user1@t-online.de",
    Framed-IP-Address = 203.0.113.1,
    Framed-IP-Netmask = 255.255.255.255,
    RtBrick-DNS-Primary = 203.0.113.200,
    RtBrick-DNS-Secondary  = 203.0.113.201,
    Framed-IPv6-Prefix = 2001:db8:0:1::/64,
    Delegated-IPv6-Prefix = 2001:db8:0:3::/56,
    RtBrick-DNS-Primary-IPv6  = 2001:db8:0:20::1,
    RtBrick-DNS-Secondary-IPv6 = 2001:db8:0:20::2,
    Session-Timeout = 0,
    Idle-Timeout = 0,
    Acct-Interim-Interval = 120,
    RtBrick-QoS-Profile = "subs-4q-profile",
    RtBrick-IGMP-Status = ENABLED,
    RtBrick-IGMP-Profile = "IPTV_user",
    RtBrick-IGMP-Max-Members = 2000,
    RtBrick-IGMP-Version = V3

DEFAULT User-Name =~ '^[0-9a-f\:]+@pppoe$', Cleartext-Password := 'pppoe'
    Service-Type = Framed-User,
    Class = "PPPOE",
    Acct-Interim-Interval = 900

The pppoe_users_file can be created with the above content in the /etc/freeradius/3.0/ path. Alternatively, this file can be downloaded from the appendix section of this guide and placed at /etc/freeradius/3.0/.

clients.conf

Clients.conf file shall be configured with the expected RADIUS client IP address and secret.

~:/etc/freeradius/3.0 # cat clients.conf
client rtbrick {
        ipaddr          = 192.0.2.74
        secret          = testing123
        shortname       = rtbrick
        nas_type        = other
        require_message_authenticator = no
}

The clients.conf file (/etc/freeradius/3.0/clients.conf) used for this reference design can be downloaded from the appendix section of this guide.

radiusd.conf

The radiusd.conf file should be configured with the expected RADIUS authentication and accounting parameters.

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct
name = freeradius
confdir = ${raddbdir}
modconfdir = ${confdir}/mods-config
run_dir = ${localstatedir}/run/${name}
db_dir = ${raddbdir}
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/${name}.pid
correct_escapes = true
max_request_time = 5
cleanup_delay = 0
max_requests = 16384
hostname_lookups = no
log {
    destination = files
    file = ${logdir}/radius.log
    stripped_names = no
    auth = yes
}
checkrad = ${sbindir}/checkrad
security {
    # user = radius
    # group = radius
    allow_core_dumps = no
    max_attributes = 200
    reject_delay = 0
    status_server = no
@openssl_version_check_config@
}
proxy_requests  = no
$INCLUDE clients.conf
thread pool {
    start_servers = 32
    max_servers = 128
    min_spare_servers = 8
    max_spare_servers = 16
    max_queue_size = 16384
    max_requests_per_server = 0
    auto_limit_acct = no
}
modules {
    $INCLUDE mods-enabled/
}
instantiate {
    files
    linelog
}
server default {
    listen {
        type = auth
        ipaddr = *
        port = 1812
    }
    listen {
        type = acct
        ipaddr = *
        port = 1813
    }
    authorize {
        update request {
            FreeRADIUS-Client-Shortname = "%{&request:Client-Shortname}"
        }
        if (&request:Client-Shortname == "rtbrick-server") {
            rtbrick-server-log
        }
        files
        pap
    }
    authenticate {
        pap
    }
    post-auth {
        if (&request:Client-Shortname == "rtbrick-server") {
            rtbrick-server-log
        }
        Post-Auth-Type REJECT {
            update reply {
                Reply-Message := "Login Failed. Please check your username and password."
            }
            attr_filter.access_reject
        }
    }
    preacct {
        ok
    }
    accounting {
        if (&request:Client-Shortname == "rtbrick-server") {
            rtbrick-server-log
        }
    ok
    }
    session {
    }
}

Radiusd.conf should be configured to use UDP ports 1812 and 1813 for authentication and accounting, respectively. Additionally, rtbrick-server-log should be added to the parameters for authorise, authenticate, and accounting.

The radiusd.conf file (/etc/freeradius/3.0/radiusd.conf) used for this reference design can be downloaded from the appendix section (Appendix C) of this guide.

detail

The detail file shall be configured for the RADIUS accounting logs.

/etc/freeradius/3.0 # cat mods-enabled/detail
    permissions = 0666detail rtbrick-server-log {
    filename = ${radacctdir}/rtbrick-server-detail.log

    header = "%t;%{NAS-IP-Address};%I;%{Packet-Src-Port}"
    log_packet_header = no
}

Ensure that rtbrick-server-log is specified in the detail file.

The detail file (/etc/freeradius/3.0/mods-enabled/detail) used for this reference design can be downloaded from the appendix section (Appendix C) of this guide.

dictionary.rtbrick

Add the RtBrick RADIUS dictionary (dictionary.rtbrick) to /usr/share/freeradius/dictionary.rtbrick and include it in` /usr/share/freeradius/dictionary`.

The dictionary.rtbrick contains the RBFS attributes in FreeRADIUS format.

Click here to download the radius_config.zip, which contains the dictionary.rtbrick file.

Stopping and Starting the FreeRADIUS Server for any Changes

For any changes, stop and restart the FreeRADIUS server.

To stop the server, enter the following command:

sudo service freeradius stop

To start the server, enter the following command:

sudo service freeradius start

The FreeRadius server is now ready to provide AAA (Authentication, Accounting & Authorization) services to logging in subscribers.

Displaying the RADIUS Service Status

Run the following command to determine whether RADIUS service is active:

sudo service freeradius status

Validating PPPoE Subscriber Bring-Up

Using traffic streams on both upstream and downstream directions with traffic packets and bytes statistics, PPPoE Subscriber sessions can be "ESTABLISHED".

The validation can be performed in two steps:

  1. Establishing the PPPoE subscriber

  2. Pinging the subscriber IPv4/IPv6 address

BNG Blaster - PPPoE Subscribers with Traffic Streams

Using BNG Blaster, which emulates PPPoE clients, session traffic ("session-traffic") and streams traffic with different code-points ("streams"), one can test PPPoE subscriber management feature.

The data traffic can be defined in Blaster by configuring session/streams traffic.

  • Session Traffic in Blaster can be enabled by specifying "autostart": true. Once the session is established, traffic starts automatically. Eventually if you want to stop or start the traffic (session or streams), press F7/F8.

  • Streams traffic in Blaster can be enabled by specifying stream-group-id at both streams ("streams":) and access interface levels (interfaces:access).

For information about using BNG Blaster, see Starting BNG Blaster.

Validating the PPPoE Session on BNG Blaster

To validate the PPPoE Session on BNG Blaster, switch to the Service Node. On the BNG Blaster terminal, the count of the "Established" session will be 1. Also, the logging of the same terminal will display "ALL SESSIONS ESTABLISHED" and "ALL SESSION TRAFFIC FLOWS VERIFIED" as highlighted in the below image.

In the image below, one can see the details of the established Single Subscriber session.

image
Figure 2. BNG Blaster Terminal View

Visit the following URL for more information on BNG Blaster:

https://rtbrick.github.io/bngblaster/

Viewing the Subscribers and the Subscriber Details on RBFS

Enter the following command to view the list of subscribers.

supervisor@rtbrick: op> show subscriber
Subscriber-Id           Interface         VLAN       Type    State
72339069014638594       ifp-0/1/16        1001:1001  PPPoE   ESTABLISHED

Enter the following command to view the details of the subscriber with ID 216454257090494470.

supervisor@rtbrick: op> show subscriber 72339069014638594 detail
Subscriber-Id: 72339069014638594
    Type: PPPoE
    State: ESTABLISHED
    Created: Fri Aug 21 08:33:47 GMT +0000 2026
    Interface: ifp-0/1/16
    Outer VLAN: 1001 (802.1q)
    Inner VLAN: 1001
    Client MAC: 02:00:00:00:00:01
    Server MAC: e8:c5:7a:8f:78:23
    IFL: ppp-0/1/16/72339069014638594
    Username: user1@t-online.de
    Agent-Remote-Id: DEU.RTBRICK.1
    Agent-Circuit-Id: 0.0.0.0/0.0.0.0 eth 0:1
    Access-Profile: pppoe
    AAA-Profile: aaa-profile
    Service-Profile: qos_service
    Session-Timeout: 0 seconds (disabled)
    Idle-Timeout: 0 seconds (disabled)
    MTU: 1492, Profile: __default_pppoe__
    IPv4:
        Instance: default
        Address: 203.0.113.1/255.255.255.255
        Address Active: True
        Primary DNS: 203.0.113.200
        Secondary DNS: 203.0.113.201
    IPv6:
        Instance: default
        Prefix: 2001:db8:0:1::/64
        Prefix Active: True
        Delegated Prefix: 2001:db8::/56
        Delegated Prefix Active: True
        Primary DNS: 2001:db8:0:20::1
        Secondary DNS: 2001:db8:0:20::2
    Accounting:
        Session-Id: 72339069014638594:1787301227
        Start-Time: 2026-08-21T08:33:47.501113+0000
        Interims Interval: 120 seconds

Pinging the Subscriber (source: PPPoE) from Multiservice Edge.

Before pinging a subscriber, use the show route <…​> command to display the subscriber IPs at the Multiservice Edge.

supervisor@rtbrick.net: cfg> show route ipv4 unicast source pppoe
Instance: default, AFI: ipv4, SAFI: unicast
Prefix/Label                             Source            Pref    Next Hop                                 Interface
203.0.113.1/32                           pppoe              7       -                                        pppoe-0/1/30/216454257090494470
supervisor@rtbrick.net: cfg> show route ipv6 unicast source pppoe
Instance: default, AFI: ipv6, SAFI: unicast
Prefix/Label                             Source            Pref    Next Hop                                 Interface
2001:db8:0:1::1/64                       pppoe              7       -                                        pppoe-0/1/30/216454257090494470
2001:db8:0:3::/56                        pppoe              7       fe80::ffff:ffff:ff00:1                   pppoe-0/1/30/216454257090494470

From the above list, ping 203.0.113.1 as shown below.

supervisor@rtbrick.net: cfg> ping 203.0.113.1
68 bytes from 203.0.113.1: icmp_seq=1 ttl=64 time=1.3463 ms
68 bytes from 203.0.113.1: icmp_seq=2 ttl=64 time=10.5234 ms
68 bytes from 203.0.113.1: icmp_seq=3 ttl=64 time=9.8053 ms
68 bytes from 203.0.113.1: icmp_seq=4 ttl=64 time=11.0041 ms
68 bytes from 203.0.113.1: icmp_seq=5 ttl=64 time=10.9300 ms
Statistics: 5 sent, 5 received, 0% packet loss

Validating Traffic Streams

Traffic streams can be used to perform various forwarding verifications.

For upstream traffic capture, enter the following command:

capture interface ifp-0/1/16 direction in

For downstream traffic capture, enter the following command:

capture interface ifp-0/1/16 direction out

Here, ifp-0/1/16 refers to the access interface.

Validating the PPPoE QoS on BNG Blaster

To validate the PPPoE QoS on BNG Blaster, switch to the Service Node. Navigate to the Streams and Session Traffic terminal by pressing F1 function key on your keyboard.

Blaster Upstream Downstream QoSValidation
Figure 3. Reading output from BNG Blaster

As shown in the above image, the VoIP downstream traffic has been shaped (session shaping) to 2Mbps. Similarly, the total subscriber traffic has been shaped approximately to 10Mbps.

Following are the upstream traffic rates of different policer levels:

  • Level-1 Rates ~=2.5Mbps

  • Level-2 Rates ~=3.5Mbps

  • Level-3 Rates ~=4.5Mbps

  • Level-4 Rates ~=1.5Mbps

PPPoE Subscriber Accounting for Upstream and Downstream Traffic

Run the "show subscriber" command to view the list of subscribers.

supervisor@rtbrick: op> show subscriber
Subscriber-Id           Interface         VLAN       Type    State
72339069014638594       ifp-0/1/16        1001:1001  PPPoE   ESTABLISHED

Specify the Subscriber-ID to find the specific subscriber’s accounting details:

supervisor@rtbrick: op> show subscriber 72339069014638594 accounting
Subscriber-Id: 72339069014638594
    IFL: ppp-0/1/16/72339069014638594
    Start Timestamp: Fri Aug 21 08:33:47 GMT +0000 2026
    Idle Timestamp: Fri Aug 21 08:36:08 GMT +0000 2026
    Session-Timeout: 0 seconds
    Idle-Timeout: 0 seconds
    Session Statistics:
        Ingress: 171256 packets 171941024 bytes
        Egress: 157139 packets 161853170 bytes
    IFL Statistics:
        Ingress: 0 packets 0 bytes
        Egress: 0 packets 0 bytes
    Egress Class (Queue) Statistics:
        class-0: 4 packets 4120 bytes dropped: 167834 packets 171526348 bytes
        class-1: 125699 packets 129469970 bytes dropped: 129314 packets 132158908 bytes
        class-2: 4 packets 4120 bytes dropped: 109579 packets 111989738 bytes
        class-3: 31432 packets 32374960 bytes dropped: 223826 packets 228750172 bytes
        class-4: 0 packets 0 bytes dropped: 0 packets 0 bytes
        class-5: 0 packets 0 bytes dropped: 0 packets 0 bytes
        class-6: 0 packets 0 bytes dropped: 0 packets 0 bytes
        class-7: 0 packets 0 bytes dropped: 0 packets 0 bytes
    Ingress Policer Statistics:
        Level 1: 34364 packets 34501456 bytes dropped: 245984 packets 246967936 bytes
        Level 2: 51067 packets 51271268 bytes dropped: 229292 packets 230209168 bytes
        Level 3: 68642 packets 68916568 bytes dropped: 211594 packets 212440376 bytes
        Level 4: 17183 packets 17251732 bytes dropped: 263179 packets 264231716 bytes

Configuring Lawful Intercept (LI)

This section is still a work in progress.