When applying dynamic filter to the inet/inet6 interface in the dynamic profile, the subscriber login failure due to NACK from DFW.

Refer below error log from bbe-smgd traceoption:

May 23 16:17:21 dprof_process_request: Request is a client instantiation for "dhcp-demux", session_id=xxx 
May 23 16:17:21 dprof_build_and_send_response: NACK from DFW sent for request: xxxxx, error: 13 cfg_err: 1

Applying dynamic filter to the inet/inet6 interface in the dynamic profile,refer below example:

user@mx#set dynamic-profiles dhcp-demux interfaces demux0 unit "$junos-interface-unit" family inet filter input "$junos-input-filter"

Enable bbe-smgd traceoption:

set system processes smg-service traceoptions file smgd-trace
set system processes smg-service traceoptions level all
set system processes smg-service traceoptions flag all

From bbe-smgd traceoption log, the subscriber login failure reason is "NACK received for profile request id: xxxxx from server plugin: DFW".

Refer below example:

May 23 16:17:21 dprof_process_request: Request is a client instantiation for "dhcp-demux", session_id=xxx 
May 23 16:17:21 dprof_build_and_send_response: NACK from DFW sent for request: xxxxx, error: 13 cfg_err: 1
...
May 23 16:17:21 dprof_response_handler: NACK received for profile request id: xxxxx from server plugin: DFW, error code: 0x0701000d
May 23 16:17:21 dprof_get_service_flag: No SDB_SERVICE_INFO_FLAGS for service session_id=xxx, err=-7
May 23 16:17:21 dprof_response_handler: No SDB_SERVICE_INFO_FLAGS for session_id=xxx 

Enable authd traceoption:

set system processes general-authentication-service traceoptions file jw-aaa
set system processes general-authentication-service traceoptions flag all

From authd traceoption log,find related session radius server returned filter name.

Refer below example, radius server returned input filter name is "10M" in access accept message:

May 24 15:51:54.550667 radius-access-request: Acct-Session-Id added: xxx
...
May 24 15:51:54.552009 radius-access-accept: Ingress-Policy-Name (Juniper-ERX-VSA) received: 10M

Using below cli to check if "10M" filter is exist and "interface-specific" knob has been added.

user@mx# show firewall | display set | match 10M

If there is no "10M" filter, added filter named "10M" as customer's requirement.

Refer below example:

user@mx# set firewall family inet filter 10M interface-specific
user@mx# set firewall family inet filter 10M term 1 then policer 10m
user@mx# set firewall family inet filter 10M, term 1 then accept
user@mx# set firewall policer 10m if-exceeding bandwidth-limit 10m
user@mx# set firewall policer 10m if-exceeding burst-size-limit 15k
user@mx# set firewall policer 10m then discard