Description

This article provides information about how to do bandwidth limitation for dual stack ppppoe session.


Symptoms

Sample configuration for bandwidth limitation for dual stack session.

Solution

The normally dynamic-profile configuration for dual stack pppoe:

 

dynamic-profiles {

  DualStack-ae-pppoe {

    predefined-variable-defaults {

      input-filter up512k-v4;

      output-filter down512k-v4;

      input-ipv6-filter up512k-v6;

      output-ipv6-filter down512k-v6;

    }

    interfaces {

      pp0 {

        unit "$junos-interface-unit" {

          actual-transit-statistics;

          ppp-options {

            pap;

          }

          pppoe-options {

            underlying-interface "$junos-underlying-interface";

            server;

          }

          targeted-distribution;

          keepalives interval 30;

          family inet {    

            filter {

              input "$junos-input-filter";

              output "$junos-output-filter";

            }

            unnumbered-address "$junos-loopback-interface";

          }

          family inet6 {

            filter {

              input "$junos-input-ipv6-filter";

              output "$junos-output-ipv6-filter";

            }

            address $junos-ipv6-address;

          }

        }

      }

    }

    protocols {

      router-advertisement {

        interface "$junos-interface-name" {

          other-stateful-configuration;

        }

      }

    }

  }



}





Type: PPPoE

User Name: spirent

IP Address: 100.0.0.30

IP Netmask: 255.255.255.255

IPv6 Address: 2401:ce00:c412::2

IPv6 Prefix: 2401:ce00:c416:6::/64

Logical System: default

Routing Instance: vr03

Interface: pp0.3221225528

Interface type: Dynamic

Underlying Interface: demux0.3221225495

Dynamic Profile Name: DualStack-ae-pppoe

Dynamic Profile Version: 2

MAC Address: 00:10:94:00:00:01

State: Active

Radius Accounting ID: 59

Session ID: 59

PFE Flow ID: 176

Stacked VLAN Id: 100

VLAN Id: 2200

Login Time: 2024-10-31 15:59:49 CST

IP Address Pool: v4-pool

IPv6 Address Pool: v6-pool        

IPv6 Framed Interface Id: 0:0:0:3b

IPv4 Input Filter Name: up512k-v4-pp0.3221225528-in

IPv4 Output Filter Name: down512k-v4-pp0.3221225528-out

IPv6 Input Filter Name: up512k-v6-pp0.3221225528-in

IPv6 Output Filter Name: down512k-v6-pp0.3221225528-out

​

We can see there is two type of filters to do bandwidth limitation, inet4 filter does limitation for IPv4 traffic, inet6 filter does limitation for IPv6 traffic. They are working alone. 

How to do limitation for both IPv4 and IPv6 traffic together? We need the 3rd. type of filter, interface filter.

 

 

firewall {

  family any {

    filter down512k-any {

      interface-specific;

      term 100 {

        then policer 512k;

      }

    }

    filter up512k-any {

      interface-specific;

      term 100 {

        then policer 512k;

      }

    }

  }

}

dynamic-profiles {

  DualStack-ae-pppoe {

    predefined-variable-defaults {

      input-filter up512k-v4;

      output-filter down512k-v4;

      input-interface-filter up512k-any;

      output-interface-filter down512k-any;

      input-ipv6-filter up512k-v6;

      output-ipv6-filter down512k-v6;

    }

    interfaces {

      pp0 {

        unit "$junos-interface-unit" {

          actual-transit-statistics;

          ppp-options {

            pap;

          }

          pppoe-options {

            underlying-interface "$junos-underlying-interface";

            server;

          }

          targeted-distribution;

          keepalives interval 30;

          filter {       

            input "$junos-input-interface-filter";

            output "$junos-output-interface-filter";

          }

          family inet {

            filter {

              input "$junos-input-filter";

              output "$junos-output-filter";

            }

            unnumbered-address "$junos-loopback-interface";

          }

          family inet6 {

            filter {

              input "$junos-input-ipv6-filter";

              output "$junos-output-ipv6-filter";

            }

            address $junos-ipv6-address;

          }

        }

      }

    }

    protocols {

      router-advertisement {

        interface "$junos-interface-name" {

          other-stateful-configuration;

        }

      }

    }

  }



}







Type: PPPoE

User Name: spirent

IP Address: 100.0.0.31

IP Netmask: 255.255.255.255

IPv6 Address: 2401:ce00:c412::3

IPv6 Prefix: 2401:ce00:c416:6::/64

Logical System: default

Routing Instance: vr03

Interface: pp0.3221225530

Interface type: Dynamic

Underlying Interface: demux0.3221225495

Dynamic Profile Name: DualStack-ae-pppoe

Dynamic Profile Version: 2

MAC Address: 00:10:94:00:00:01

State: Active

Radius Accounting ID: 61

Session ID: 61

PFE Flow ID: 180

Stacked VLAN Id: 100

VLAN Id: 2200

Login Time: 2024-10-31 16:07:13 CST

IP Address Pool: v4-pool

IPv6 Address Pool: v6-pool        

IPv6 Framed Interface Id: 0:0:0:3d

IPv4 Input Filter Name: up512k-v4-pp0.3221225530-in

IPv4 Output Filter Name: down512k-v4-pp0.3221225530-out

IPv6 Input Filter Name: up512k-v6-pp0.3221225530-in

IPv6 Output Filter Name: down512k-v6-pp0.3221225530-out

IFL Input Filter Name: up512k-any-pp0.3221225530-in

IFL Output Filter Name: down512k-any-pp0.3221225530-out



The ifl filter works protocol-independent. It can limit both IPv4 and IPv6 traffic.

 

 

The new question, how to do it with radius?

 

Juniper Networks supported VSAs. 

 

26-​10 Ingress-​Policy-​Name

26-​11 Egress-​Policy-​Name

 

 

It can be used for IPv4 filter and interface filter. 

Notice, doesn't apply both level as same time. The filter type must be same as where you apply.

 

 

 

dynamic-profiles {

  DualStack-ae-pppoe {

    predefined-variable-defaults {

      input-filter up512k-any;

      output-filter down512k-any;

    }

    interfaces {

      pp0 {

        unit "$junos-interface-unit" {

          actual-transit-statistics;

          ppp-options {

            pap;

          }

          pppoe-options {

            underlying-interface "$junos-underlying-interface";

            server;

          }

          targeted-distribution;

          keepalives interval 30;

          filter {

            input "$junos-input-filter";

            output "$junos-output-filter";

          }

          family inet {

            unnumbered-address "$junos-loopback-interface";

          }

          family inet6 {

            address $junos-ipv6-address;

          }

        }

      }

    }

    protocols {

      router-advertisement {

        interface "$junos-interface-name" {

          other-stateful-configuration;

        }

      }

    }

  }

}





Type: PPPoE

User Name: spirent

IP Address: 100.0.0.34

IP Netmask: 255.255.255.255

IPv6 Address: 2401:ce00:c412::6

IPv6 Prefix: 2401:ce00:c416:6::/64

Logical System: default

Routing Instance: vr03

Interface: pp0.3221225536

Interface type: Dynamic

Underlying Interface: demux0.3221225495

Dynamic Profile Name: DualStack-ae-pppoe

Dynamic Profile Version: 2

MAC Address: 00:10:94:00:00:01

State: Active

Radius Accounting ID: 67

Session ID: 67

PFE Flow ID: 192

Stacked VLAN Id: 100

VLAN Id: 2200

Login Time: 2024-11-04 12:12:00 CST

IP Address Pool: v4-pool

IPv6 Address Pool: v6-pool        

IPv6 Framed Interface Id: 0:0:0:43

IFL Input Filter Name: up512k-any-pp0.3221225536-in

IFL Output Filter Name: down512k-any-pp0.3221225536-out

Modification History

2024-11-04 : Article Created

2024-11-05: Formated.