Description

This article explains how to create subscribers for statically configured interfaces on next generation subscriber-management architecture.

Solution

Static subscribers are supported beginning with version 16.1R4 in the next generation subscriber-management release.

There can be at most one static subscriber over a given interface. The CLI configuration describes which interfaces have an associated subscriber with it. These subscribers “login” whenever the interface comes up (i.e., operational state up) and “logout” whenever the interface goes down up (i.e., operational state down).

Static subscribers can also be authenticated/authorized via RADIUS. This procedure allows RADIUS to keep track of this subscriber and later issue service activation/de-activation commands via CoA requests.

When RADIUS authentication/authorization is enabled, there is a limited support for what can be achieved. Authentication failure does not prevent the underlying interface from coming up and forwarding traffic. It only prevents the “subscriber” from coming up, and therefore service activation/de-activation to occur.

Once static subscribers are created (logged in) in the Subscriber Database (SDB), the local Session and Resource Control (SRC) peer (JSRC) reports these subscribers to SRC via Diameter protocol. SRC then manages these static subscribers in a similar fashion as how it manages other subscribers.

Configuration

user@ERX-MX960-RE0# show system services
static-subscribers {
    access-profile {
        test;
    }
    dynamic-profile {
        junos-default-profile;
    }
    authentication {
        password “$ABC123"; ## SECRET-DATA
        username-include {
            user-prefix test;
        }
    }
    group test {
        interface demux0.1;
    }
}

user@ERX-MX960-RE0# show interfaces
xe-8/0/0 {
    flexible-vlan-tagging;
    unit 1 {
        demux-source inet;
        vlan-tags outer 850 inner 850;
        family inet {
            unnumbered-address lo0.0;
        }
    }
}
demux0 {
    unit 1 {
        demux-options {
            underlying-interface xe-8/0/0.1;
        }
        family inet {
            demux-source {
                192.168.1.2/30;
            }
            address 192.168.1.1/30;
        }
    }
}
si-4/0/0 {
    unit 0 {
        family inet;
        family inet6;
    }
}
lo0 {
    unit 0 {
        family inet {
            address 30.40.50.60/32;
        }
        family inet6 {
            address 2001::2/128;
        }
    }
}


user@ERX-MX960-RE0# show access
profile test {
    accounting-order radius;
    authentication-order radius;
    radius {
        authentication-server 10.219.48.248;
        accounting-server 10.219.48.248;
        options {
            client-authentication-algorithm round-robin;
            client-accounting-algorithm round-robin;
            juniper-dsl-attributes;
        }
    }
    radius-server {
        10.219.48.248 {
            port 1812;
            accounting-port 1813;
            dynamic-request-port 3799;
            secret "$ABC123"; ## SECRET-DATA
            timeout 120;
            retry 5;
            source-address 10.219.35.196;
        }
    }
    accounting {
        order radius;
        update-interval 10;
        statistics volume-time;
    }
}

Traceoption

user@ERX-MX960-RE0# show system processes
static-subscribers {
    traceoptions {
        level all;
        flag all;
    }
}

Verification

Use the following commands to provide administrative control of static subscribers:

request services static-subscribers login interface interface-name
request services static-subscribers logout interface interface-name
request services static-subscribers login group group-name
request services static-subscribers logout group group-name

Use the following commands to monitor static subscribers:

show static-subscribers
show static-subscribers interface interface-name
show static-subscribers group group-name

user@ERX-MX960-RE0# run show subscribers
Interface           IP Address/VLAN ID                      User Name                      LS:RI
demux0.1            192.168.1.0                               test                      default:default      

user@ERX-MX960-RE0# run show static-subscribers sessions    
Static subscriber information:
Interface         State                  Group            User Name
demux0.1          logged in              test             test    

user@ERX-MX960-RE0# run show subscribers extensive                            
Type: STATIC-INTERFACE
User Name: test
IP Address: 192.168.1.0
IP Netmask: 255.255.255.252
Logical System: default
Routing Instance: default
Interface: demux0.1
Interface type: Static
Underlying Interface: xe-8/0/0.1
Dynamic Profile Name: junos-default-profile
Dynamic Profile Version: 0
State: Active
Radius Accounting ID: 13
Session ID: 13
PFE Flow ID: 4
Login Time: 2017-06-11 11:23:49 IST
Accounting interval: 600

There are two new functionalities:

  1. Auto-login : The static subscribers, when logged out by the operator, will automatically re-login without operator intervention. This will be the non-default behavior and is configuration controlled. This configuration can be done at the static subscriber group level (or) system wide.

  2. Baseline-stats : The static-subscriber statistics, reported via accounting messages to RADIUS, will be baseline to start from zero at the time of fresh login. This will be the non-default behavior and is configuration controlled.

This configuration can be done only system wide.

Example: Auto-login

  • Without Auto-login, Static subscriber logout will not automatically login

user@ERX-MX960-RE0 # run show static-subscribers sessions
Static subscriber information:
Interface         State                  Group            User Name
demux0.1          logged in              test             test                  

user@ERX-MX960-RE0# run request services static-subscribers logout group test   
Operation succeed

user@ERX-MX960-RE0# run show static-subscribers sessions   

  • With Auto-login, static-subscriber will be automatically login.


user@ERX-MX960-RE0# show system services
static-subscribers {
    access-profile {
        test;
    }
    dynamic-profile {
        junos-default-profile;
    }
    authentication {
        password “$ABC123"; ## SECRET-DATA
        username-include {
            user-prefix test;
        }
    }
    group test {
        interface demux0.1;
    }
    auto-login;
}

tac@ERX-MX960-RE0# run show static-subscribers sessions
Static subscriber information:
Interface         State                  Group            User Name
demux0.1          logged in              test             test    

user@ERX-MX960-RE0# run request services static-subscribers logout group test    
Operation succeed

user@ERX-MX960-RE0# run show static-subscribers sessions                         
Static subscriber information:
Interface         State                  Group            User Name
demux0.1          logged in              test             test                  

Example: Baseline-Stats

  • Without Baseline-stats, Accounting Stats will not be base lined on fresh login.

user@ERX-MX960-RE0# run show interfaces demux0.1 extensive    
  Logical interface demux0.1 (Index 365) (SNMP ifIndex 1883) (Generation 174)
    Flags: Up SNMP-Traps 0x4000 Encapsulation: ENET2
    Demux:
      Underlying interface: xe-8/0/0.1 (Index 364)
      Family Inet Source prefixes, total 1
          Prefix: 192.168.1.2/30
    Traffic statistics:
     Input  bytes  :                   60
     Output bytes  :              1095030
     Input  packets:                    1
     Output packets:                 2001
    Local statistics:
     Input  bytes  :                   60
     Output bytes  :                   46
     Input  packets:                    1
     Output packets:                    1
    Transit statistics:
     Input  bytes  :                    0                    0 bps
     Output bytes  :              1094984                    0 bps
     Input  packets:                    0                    0 pps
     Output packets:                 2000                    0 pps
    Protocol inet, MTU: 1500
    Max nh cache: 75000, New hold nh limit: 75000, Curr nh cnt: 1, Curr new hold cnt: 0, NH drop cnt: 0
    Generation: 212, Route table: 0
      Flags: Sendbcast-pkt-to-re
      Addresses, Flags: Is-Preferred Is-Primary
        Destination: 192.168.1.0/30, Local: 192.168.1.1, Broadcast: 192.168.1.3, Generation: 150

user@ERX-MX960-RE0# run request services static-subscribers logout group test
Operation succeed

Jun 11 12:16:09.509722 radius-acct-stop: User-Name added: test
Jun 11 12:16:09.509735 radius-acct-stop: Acct-Status-Type added: 2
Jun 11 12:16:09.509748 radius-acct-stop: Acct-Session-Id added: 1
Jun 11 12:16:09.509769 radius-acct-stop: Event-Timestamp added: 2017-06-11 12:16:09
Jun 11 12:16:09.509783 radius-acct-stop: Acct-Input-Octets added: 0
Jun 11 12:16:09.509795 radius-acct-stop: Acct-Output-Octets added: 1094984
Jun 11 12:16:09.509809 radius-acct-stop: Acct-Session-Time added: 174
Jun 11 12:16:09.509821 radius-acct-stop: Acct-Input-Packets added: 0
Jun 11 12:16:09.509832 radius-acct-stop: Acct-Output-Packets added: 2000
Jun 11 12:16:09.509852 radius-acct-stop: Acct-Terminate-Cause added: 6

user@ERX-MX960-RE0# run show interfaces demux0.1 extensive                       
  Logical interface demux0.1 (Index 365) (SNMP ifIndex 1883) (Generation 174)
    Flags: Up SNMP-Traps 0x4000 Encapsulation: ENET2
    Demux:
      Underlying interface: xe-8/0/0.1 (Index 364)
      Family Inet Source prefixes, total 1
          Prefix: 192.168.1.2/30
    Traffic statistics:
     Input  bytes  :                   60
     Output bytes  :              1642530
     Input  packets:                    1
     Output packets:                 3001
    Local statistics:
     Input  bytes  :                   60
     Output bytes  :                   46
     Input  packets:                    1
     Output packets:                    1
    Transit statistics:
     Input  bytes  :                    0                    0 bps
     Output bytes  :              1642484                    0 bps
     Input  packets:                    0                    0 pps
     Output packets:                 3000                    0 pps
    Protocol inet, MTU: 1500
    Max nh cache: 75000, New hold nh limit: 75000, Curr nh cnt: 1, Curr new hold cnt: 0, NH drop cnt: 0
    Generation: 212, Route table: 0
      Flags: Sendbcast-pkt-to-re
      Addresses, Flags: Is-Preferred Is-Primary
        Destination: 192.168.1.0/30, Local: 192.168.1.1, Broadcast: 192.168.1.3, Generation: 150

user@ERX-MX960-RE0# run request services static-subscribers logout group test    
Operation succeed

Jun 11 12:17:29.400691 radius-acct-stop: User-Name added: test
Jun 11 12:17:29.400705 radius-acct-stop: Acct-Status-Type added: 2
Jun 11 12:17:29.400718 radius-acct-stop: Acct-Session-Id added: 2
Jun 11 12:17:29.400739 radius-acct-stop: Event-Timestamp added: 2017-06-11 12:17:29
Jun 11 12:17:29.400752 radius-acct-stop: Acct-Input-Octets added: 0
Jun 11 12:17:29.400764 radius-acct-stop: Acct-Output-Octets added: 1642484
Jun 11 12:17:29.400776 radius-acct-stop: Acct-Session-Time added: 79
Jun 11 12:17:29.400788 radius-acct-stop: Acct-Input-Packets added: 0
Jun 11 12:17:29.400799 radius-acct-stop: Acct-Output-Packets added: 3000
Jun 11 12:17:29.400815 radius-acct-stop: Acct-Terminate-Cause added: 6

  •  With baseline-stats, Accounting stats are getting base lined on fresh login.

user@ERX-MX960-RE0# show system services static-subscribers
access-profile {
    test;
}
dynamic-profile {
    junos-default-profile;
}
authentication {
    password “$ABC123"; ## SECRET-DATA
    username-include {
        user-prefix test;
    }
}
group test {
    interface demux0.1;
}
auto-login;
baseline-stats;
}

user@ERX-MX960-RE0# run show interfaces demux0.1 extensive    
  Logical interface demux0.1 (Index 365) (SNMP ifIndex 1883) (Generation 174)
    Flags: Up SNMP-Traps 0x4000 Encapsulation: ENET2
    Demux:
      Underlying interface: xe-8/0/0.1 (Index 364)
      Family Inet Source prefixes, total 1
          Prefix: 192.168.1.2/30
    Traffic statistics:
     Input  bytes  :                   60
     Output bytes  :              2190030
     Input  packets:                    1
     Output packets:                 4001
    Local statistics:
     Input  bytes  :                   60
     Output bytes  :                   46
     Input  packets:                    1
     Output packets:                    1
    Transit statistics:
     Input  bytes  :                    0                    0 bps
     Output bytes  :              2189984                    0 bps
     Input  packets:                    0                    0 pps
     Output packets:                 4000                    0 pps
    Protocol inet, MTU: 1500
    Max nh cache: 75000, New hold nh limit: 75000, Curr nh cnt: 1, Curr new hold cnt: 0, NH drop cnt: 0
    Generation: 212, Route table: 0
      Flags: Sendbcast-pkt-to-re
      Addresses, Flags: Is-Preferred Is-Primary
        Destination: 192.168.1.0/30, Local: 192.168.1.1, Broadcast: 192.168.1.3, Generation: 150
        
user@ERX-MX960-RE0# run request services static-subscribers logout group test    
Operation succeed


Jun 11 12:21:19.697555 radius-acct-stop: User-Name added: test
Jun 11 12:21:19.697568 radius-acct-stop: Acct-Status-Type added: 2
Jun 11 12:21:19.697581 radius-acct-stop: Acct-Session-Id added: 4
Jun 11 12:21:19.697601 radius-acct-stop: Event-Timestamp added: 2017-06-11 12:21:19
Jun 11 12:21:19.697614 radius-acct-stop: Acct-Input-Octets added: 0
Jun 11 12:21:19.697626 radius-acct-stop: Acct-Output-Octets added: 547500
Jun 11 12:21:19.697637 radius-acct-stop: Acct-Session-Time added: 82
Jun 11 12:21:19.697654 radius-acct-stop: Acct-Input-Packets added: 0
Jun 11 12:21:19.697666 radius-acct-stop: Acct-Output-Packets added: 1000
Jun 11 12:21:19.697679 radius-acct-stop: Acct-Terminate-Cause added: 6

Dynamic Service Activation/Deactivation

Static subscribers work with the native Juniper Networks Session and Resource Control, or you can configure RADIUS to activate and deactivate the services with change of authorization (CoA) messages.

Example

user@ERX-MX960-RE0# show dynamic-profiles test
variables {
    filter;
    prec;
}
interfaces {
    demux0 {
        unit "$junos-underlying-interface-unit" {
            family inet {
                filter {
                    input "$filter" precedence "$prec";
                    output "$filter" precedence "$prec";
                }
            }
        }
    }
}

[root@JTAC-ERX-LINUX-3 ~]# radclient -x -s 10.219.35.196:3799 coa secret -f coa -d /usr/share/freeradius
Sending CoA-Request of id 176 to 10.219.35.196 port 3799
        Acct-Session-Id := "5"
        ERX-Service-Activate:1 := "test(12M,60)"
rad_recv: CoA-ACK packet from host 10.219.35.196 port 3799, id=176, length=20

           Total approved auths:  1
             Total denied auths:  0
               Total lost auths:  0

user@ERX-MX960-RE0# run show subscribers extensive    
Type: STATIC-INTERFACE
User Name: test
IP Address: 192.168.1.0
IP Netmask: 255.255.255.252
Logical System: default
Routing Instance: default
Interface: demux0.1
Interface type: Static
Underlying Interface: xe-8/0/0.1
Dynamic Profile Name: junos-default-profile
Dynamic Profile Version: 0
State: Active
Radius Accounting ID: 5
Session ID: 5
PFE Flow ID: 4
Login Time: 2017-06-11 12:21:19 IST
Service Sessions: 1
Accounting interval: 600

   Service Session ID: 6
   Service Session Name: test
   Service Session Version: 1
   State: Active
   Family: inet
   IPv4 Input Filter Name: 12M-demux0.1-in
   IPv4 Output Filter Name: 12M-demux0.1-out
   Service Activation time: 2017-06-11 13:08:59 IST
   Dynamic configuration:
     filter: 12M
     prec: 60

[root@JTAC-ERX-LINUX-3 ~]# radclient -x -s 10.219.35.196:3799 coa secret -f coa -d /usr/share/freeradius
Sending CoA-Request of id 42 to 10.219.35.196 port 3799
        Acct-Session-Id := "5"
        ERX-Service-Deactivate := "test(12M,60)"
rad_recv: CoA-ACK packet from host 10.219.35.196 port 3799, id=42, length=20

           Total approved auths:  1
             Total denied auths:  0
               Total lost auths:  0

user@ERX-MX960-RE0# run show subscribers extensive    
Type: STATIC-INTERFACE
User Name: test
IP Address: 192.168.1.0
IP Netmask: 255.255.255.252
Logical System: default
Routing Instance: default
Interface: demux0.1
Interface type: Static
Underlying Interface: xe-8/0/0.1
Dynamic Profile Name: junos-default-profile
Dynamic Profile Version: 0
State: Active
Radius Accounting ID: 5
Session ID: 5
PFE Flow ID: 4
Login Time: 2017-06-11 12:21:19 IST
Accounting interval: 600

Modification History

2020-02-23: Changed encrypted password to “$ABC123".

Related Information