This article provides a sample configuration for the COA initiated lawful intercept.

The COA client is FreeRadius.

he sample configuration for JUNOS device, refer below KB: 

https://kb.juniper.net/KB24745 [juniper.net]

Using below cli to get subscriber's acct-session-id.
In below example, the acct-session-id is 4.

user@mx# run show subscribers extensive client-type pppoe
Type: PPPoE
User Name: pppoe
IP Address: 192.168.0.2
IP Netmask: 255.255.255.255
Primary DNS Address: 192.168.100.1
Secondary DNS Address: 192.168.100.2
Logical System: default
Routing Instance: default
Interface: pp0.3221225475
Interface type: Dynamic
Underlying Interface: xe-0/2/0.3221225474
Dynamic Profile Name: pppoe-profile
MAC Address: 00:10:94:00:00:01
State: Active
Radius Accounting ID: 4   
Session ID: 4
PFE Flow ID: 38
Stacked VLAN Id: 100
VLAN Id: 100
Login Time: 2024-08-02 10:10:39 CST
IP Address Pool: pppoe-p1
IPv4 Input Filter Name: 1m-pp0.3221225475-in
IPv4 Output Filter Name: 1m-pp0.3221225475-out
Accounting interval: 600

In below example, "10.0.0.2" is mediation device ip, "10.0.1.1" is coa server address(MX device).

Enable subscriber LI example:

[root@freeradius ~]# echo "Acct-Session-ID=8,Unisphere-LI-Action=1,Unisphere-Med-Dev-Handle=0x41111111,Unisphere-Med-Ip-Address=10.0.0.2,Unisphere-Med-Port-Number=20240" | radclient -x 10.0.1.1:3799 coa radius

Disable subscriber LI example:

[root@freeradius ~]# echo "Acct-Session-ID=8,Unisphere-LI-Action=0,Unisphere-Med-Dev-Handle=0x41111111,Unisphere-Med-Ip-Address=10.0.0.2,Unisphere-Med-Port-Number=20240" | radclient -x 10.0.0.1:3799 coa radius

From MX authd traceoption, We can find COA result is ACK.

============ CoA/Disconnect Callback =================
Aug 2 10:52:30.508751 dyn_req_disconnect_cb attributes remote_addr:(10.0.1.2) remote_port:(49852), rtbl_idx:(0), profile:(radius-profile)
Aug 2 10:52:30.508788 authd_extract_identifier_avps received AVP type:44 val:4 len:1
Aug 2 10:52:30.508799 authd_extract_identifier_avps: Acct-Session-Id=4
Aug 2 10:52:30.508808 authd_extract_identifier_avps received AVP type:26 val: len:24
Aug 2 10:52:30.508818 authd_extract_identifier_avps received AVP type:26 val: len:24
Aug 2 10:52:30.508827 authd_extract_identifier_avps received AVP type:26 val: len:24
Aug 2 10:52:30.508836 authd_extract_identifier_avps received AVP type:26 val: len:24
Aug 2 10:52:30.508872 authd_radius_get_config: profile radius-profile
Aug 2 10:52:30.508882 authd_radius_get_config: profile radius-profile in arm_profile_radius_tree
Aug 2 10:52:30.508904 Looked up subscriber session-id:4 access-profile-name <radius-profile>
Aug 2 10:52:30.508970 Parsing RADIUS message for session-id:4
...
Aug 2 10:52:30.692940 result-code is ACK, ERROR-MESSAGE is <>