The following excerpt is from Ascend-Data-Filter Policies for Subscriber Management Overview.

Subscriber management enables you to use Ascend-Data-Filters to create policies for subscriber traffic. An Ascend-Data-Filter is a binary value that is configured on the RADIUS server.

Subscriber management uses a dynamic profile to obtain the Ascend-Data-Filter attribute (RADIUS attribute 242) from the RADIUS server and apply the policy to a subscriber session. Dynamic profiles support Ascend-Data-Filters for inet and inet6 family types, and both families can be present in a dynamic profile.

This article provides an example for configuring a firewall filter for subscribers using Ascend-Data-Filter.

Configuration

labroot@ERX-MX480-II-RE0# show dynamic-profiles PPPoE-TEST
routing-instances {
    "$junos-routing-instance" {
        interface "$junos-interface-name" {
            any;
        }
    }
}
interfaces {
    pp0 {
        unit "$junos-interface-unit" {
            no-traps;
            ppp-options {
                chap;
                pap;
            }
            pppoe-options {
                underlying-interface "$junos-underlying-interface";
                server;
            }
            keepalives interval 30;
            family inet {
                filter {
                    input "$junos-input-filter" precedence 250;
                    output "$junos-output-filter" precedence 250;
                    adf {   <-- Ascend-Data-Filter included in dynamic-profile.
                        rule "$junos-adf-rule-v4";
                        counter;
                        input-precedence 252;
                        output-precedence 252;
                    }
                }
                     unnumbered-address "$junos-loopback-interface";
            }
        }
    }
} 

Attribute configured under RADIUS

[email protected] Cleartext-Password := "jtac123"
            Framed-IP-Address := "177.220.177.164",
            X-Ascend-Data-Filter = "ip in forward dstip 10.1.1.1/32 0 dstport = 25",
            X-Ascend-Data-Filter += "ip in forward",
            X-Ascend-Data-Filter += "0x01010100000000000000000000000000000000000000000000000b626573742d6566666f72740b706c63722d4f474f2d336d",
            ERX-Ingress-Policy-Name = "test",
            ERX-Egress-Policy-Name = "test" 

Refer to Ascend-Data-Filter Attribute Fields for more information.

"0x01010100000000000000000000000000000000000000000000000b626573742d6566666f72740b706c63722d4f474f2d336d" <-- (IPv4, Accept,Ingress, 0b=Length, 626573742d6566666f7274=best-effort, 0b=Length, 706c63722d4f474f2d336d = plcr-OGO-3m )

Refer to Online-toolz for converting text to hex.

labroot@ERX-MX480-II-RE0# run show subscribers extensive
Type: VLAN
Logical System: default
Routing Instance: default
Interface: demux0.3221225482
Interface type: Dynamic
Underlying Interface: xe-3/0/0
Dynamic Profile Name: DYN-DEMUX3
Dynamic Profile Version: 1
State: Active
Session ID: 42
PFE Flow ID: 19
VLAN Id: 100
Login Time: 2017-04-09 10:41:27 IST

Type: PPPoE
User Name: [email protected]
IP Address: 177.220.177.164
IP Netmask: 255.255.255.255
Logical System: default
Routing Instance: default
Interface: pp0.3221225483
Interface type: Dynamic
Underlying Interface: demux0.3221225482
Dynamic Profile Name: PPPoE-TEST
Dynamic Profile Version: 1
MAC Address: 6e:51:35:4e:00:00
Idle Timeout (seconds): 7200
Idle Timeout Ingress Only: FALSE
State: Active
Radius Accounting ID: 43
Session ID: 43
PFE Flow ID: 20
VLAN Id: 100
Login Time: 2017-04-09 10:41:27 IST
IPv4 Input Filter Name: test-pp0.3221225483-in
IPv4 Output Filter Name: test-pp0.3221225483-out
ADF IPv4 Input Filter Name: __junos_adf_43-pp0.3221225483-inet-in
                    Rule 0: 01010100000000000a0101010020000000000019000200000000000000000000
                            from {
                                destination-address 10.1.1.1/32;
                                destination-port 25;
                            }
                            then {
                                accept;
                            }
                    Rule 1: 0101010000000000000000000000000000000000000000000000000000000000
                            then {
                                accept;
                            }
                    Rule 2: 01010100000000000000000000000000000000000000000000000b626573742d6566666f72740b706c63722d4f474f2d336d
                            then {
                                forwarding-class best-effort;
                                policer plcr-OGO-3m;
                                accept;
                            }
Accounting interval: 600
Dynamic configuration:
      junos-adf-rule-v4: 01010100000000000a0101010020000000000019000200000000000000000000
      junos-adf-rule-v4: 0101010000000000000000000000000000000000000000000000000000000000
      junos-adf-rule-v4: 01010100000000000000000000000000000000000000000000000b626573742d6566666f72740b706c63722d4f474f2d336d
  junos-input-filter: test
  junos-output-filter: test 

2022-12-29: Updated non-compliant IP addresses and checked article for accuracy