The packet triggered subscribers feature creates IP demultiplexing interfaces (IP demux IFL) when receiving a data packet from clients with pre-assigned IP address.

There is no keepalive or control message to terminate this subscriber type (dyn-ip). For packet triggered subscribers, the only logout mechanism is set to 'idle timeout'. When the subscriber interface does not detect traffic time exceeding idle timer, the subscriber will logout.

If 'idle timeout' does not work, the offline subscribers cannot be deleted on BRAS, which might cause a subscriber session leak. Finally, the system resource will be exhausted.

This explains the reason subscribers are not released after idle timeout and provide a solution for this issue.

Refer to the documentation on Configuring Packet Triggered Subscribers Using IP Demux Interfaces in Dynamic Profiles

Set 'idle timeout':

access {
    profile radius-profile {
        session-options {
            client-idle-timeout 10;
            client-idle-timeout-ingress-only;
        }
    }
}

' client-idle-timeout-ingress-only ' means terminate the subscriber when there is no ingress data traffic for the duration of the configured idle timeout; ignore egress traffic.

Once client-idle-timeout has been set, the 'Idle Timeout' value can be seen from each subscriber extensive info:

user@mx> show subscribers client-type dyn-ip address 2005::2 detail 
Type: DYN-IP
User Name: static6
IPv6 Address: 2005::2
Logical System: default
Routing Instance: default
Interface: demux0.3221225474
Interface type: Dynamic
Underlying Interface: ae0.100
Dynamic Profile Name: static-v4v6
MAC Address: 00:10:94:07:00:01
Idle Timeout (seconds): 600        <--- client-idle-timeout has been set to 10mins
Idle Timeout Ingress Only: TRUE    <--- client-idle-timeout-ingress-only has been enabled
State: Active
Radius Accounting ID: 5
Session ID: 5
PFE Flow ID: 40
VLAN Id: 100
Login Time: 2021-09-08 16:45:10 CST
Service Sessions: 1

There is no any CLI command can check if this 'Idle Timeout' has taken effect (no timer counter). The only method is to monitor related demux interface and confirm that it has not received any traffic after idle timeout subscriber has not been released.That means 'Idle Timeout' does not work.

This may be caused by ' actual-transit-statistics ' not being configured in dynamic profile.

Starting in JunOS Release 18.4R1, 'actual-transit-statistics ' must be enabled to collect subscriber statistics. If this statement is not configured, subscriber statistics are not collected.

For details on this knob, refer to the documentation on actual-transit-statistics (Dynamic Profiles)

After setting  ' actual-transit-statistics' in dynamic profile, the client-idle-timeout will take effect.

Confirm the subscriber applied dynamic profile name from extensive output:

user@mx> show subscribers client-type dyn-ip extensive
<snip>
Dynamic Profile Name: static-v4v6
<snip>

user@mx# set dynamic-profiles static-v4v6 interfaces demux0 unit "$junos-interface-unit" actual-transit-statistics

user@mx# show | compare
[edit dynamic-profiles static-v4v6 interfaces demux0 unit "$junos-interface-unit"]
+      actual-transit-statistics;