[Subscriber Management]Failure of attaching RADIUS initiated lawful intercept policies when [ERX-Redirect-VR-Name] is used

Description

LI policy failed to be attached to subscriber interface when LI related AVPs are returned via RADIUS access-accept message, while the CoA method works well.

DEFAULT User-Name == "user-ppp-li", Cleartext-Password := "password"

ERX-Redirect-VR-Name = "default:VRF-Sub",

Framed-Pool = nat-v4-pool-1,

Framed-IPv6-Pool = ipv6-ia-na-pool-1,

Jnpr-IPv6-Delegated-Pool-Name = ipv6-dhcpv6-pd-pool-1,

ERX-LI-Action = 1,

ERX-Med-Dev-Handle = 0x41234567,

ERX-Med-Ip-Address = 10.10.10.10,

ERX-Med-Port-Number = 7933

Symptoms

RADIUS initiated lawful intercept(LI, also known as secure subscriber policy) doesn’t work for customer.

Solution

Customer uses Redirect-VR-Name to relocate the PPPoE subscribers into different routing-instances.

Troubleshooting found the problem is with the twice authentication due to Redirect-VR-Name being used.

When Redirect-VR-Name is returned, it guides MX to relocate the subscriber to the routing-instance it specifies. At the same time, it guides MX to go to RADIUS server configured in that routing-instance, and start the authentication process again.

The authd traceoqptions show this whole process.

Nov 11 08:25:52.700584 ###################################################################

Nov 11 08:25:52.700595 ########################### AUTH REQ RCVD #########################

Nov 11 08:25:52.700605 ###################################################################

Nov 11 08:25:52.700615 Auth-FSM: Process Auth-Request for session-id:8 username <user-ppp> profile <user-radius-base-prod>

Nov 11 08:25:52.700628 Auth-FSM: Process Auth-Request for session-id:8

Nov 11 08:25:52.700639 Framework: Starting authentication

Nov 11 08:25:52.700668 authd_access_profile_get: profile user-radius-base-prod found

Nov 11 08:25:52.700681 authd_advance_module_for_aaa_request_msg: result:0

Nov 11 08:25:52.700700 Authd module start session-id:8

Nov 11 08:25:52.700711 authd_radius_start_auth: Starting RADIUS authentication session-id:8

Nov 11 08:25:52.700722 authd_radius_get_config: profile user-radius-base-prod

Nov 11 08:25:52.700733 authd_radius_get_config: profile user-radius-base-prod in arm_profile_radius_tree

Nov 11 08:25:52.700743 authd_radius_get_config:Using radius option config from access profile stanza

Nov 11 08:25:52.700755 authd_access_profile_get: profile user-radius-base-prod found

Nov 11 08:25:52.700781 authd_radius_build_basic_auth_request: session-id:8 profile=user-radius-base-prod, username=user-ppp

Nov 11 08:25:52.700810 radius-access-request: User-Name added: user-ppp

Nov 11 08:25:52.700827 radius-access-request: User-Password added: ""

Nov 11 08:25:52.700856 Taking a client snapshot, session-id:8

Nov 11 08:25:52.700888 radius-access-request: Service-Type added: 2

Nov 11 08:25:52.700904 radius-access-request: Framed-Protocol added: 1

Nov 11 08:25:52.700928 radius-access-request: Chargeable-User-Identity added:

Nov 11 08:25:52.700946 radius-access-request: Acct-Session-Id added: 8

Nov 11 08:25:52.700961 radius-access-request: Calling-Station-Id added: AVC0001

Nov 11 08:25:52.700980 radius-access-request: DHCP-MAC-Address (Juniper-ERX-VSA) added: 0010.9400.0002

Nov 11 08:25:52.701005 radius-access-request: NAS-Identifier added: host

Nov 11 08:25:52.701021 radius-access-request: NAS-Port added: 00 24 00 01

Nov 11 08:25:52.701050 radius-access-request: NAS-Port-Id added: host:ae4.3221225478:1600-1:AVC0001:1600-1

Nov 11 08:25:52.701075 radius-access-request: NAS-Port-Type added: 15

Nov 11 08:25:52.701114 radius-access-request: Client-Profile-Name (Juniper-ERX-VSA) added: user-engine-ppp-ufb-client:

Nov 11 08:25:52.701140 radius-access-request: PPPoE-Description (Juniper-ERX-VSA) added: pppoe 00:10:94:00:00:02

Nov 11 08:25:52.701172 radius-access-request: 1: Agent-Circuit-Id (DSL Forum-VSA) Sub-Attribute added: circuit 0

Nov 11 08:25:52.701188 radius-access-request: 2: Agent-Remote-Id (DSL Forum-VSA) Sub-Attribute added: AVC0001

Nov 11 08:25:52.701216 authd_create_application_specific_radius_server: Evaluating RADIUS server 10.219.83.15 to add to the server list

Nov 11 08:25:52.701229 Evaluating RADIUS server 10.219.83.15 to add to the server list

Nov 11 08:25:52.701244 Verify source address adb2498 in routing instance index=36738

Nov 11 08:25:52.701296 authd_radius_server_add: server 10.219.83.15 retry 3, timeout 10 acct_request 0

Nov 11 08:25:52.701315 processSessionAttributeNasAddress 8

Nov 11 08:25:52.701326 processSessionAttributeNasAddress return false

Nov 11 08:25:52.701397 Request queued successfully

Nov 11 08:25:52.701414 REQUEST: AUTHEN - module_index 0 module(radius) return: ASYNC

Nov 11 08:25:52.701435 UserAccess:user-ppp session-id:8 state:start host:ae4.3221225478:1600-1:AVC0001:1600-1

Nov 11 08:25:52.701451 Auth-FSM: GRES-Mirror for session-id:8 state:AuthStart(1)

Nov 11 08:25:52.701896 authd_radius_get_config: profile user-radius-base-prod

Nov 11 08:25:52.701912 authd_radius_get_config: profile user-radius-base-prod in arm_profile_radius_tree

Nov 11 08:25:52.701922 authd_radius_get_config:Using radius option config from access profile stanza

Nov 11 08:25:52.701933 RadiusServer: authd_radius_mark_servers_dead : 1 servers radius config, probably config changed

Nov 11 08:25:52.701945 RadiusServer: server[0] used for last request - 10.10.10.10

Nov 11 08:25:52.701966 loadDefaultService:: default service for the subscriber is empty

Nov 11 08:25:52.701977 Radius result is CLIENT_REQ_STATUS_SUCCESS

Nov 11 08:25:52.702000 Parsing RADIUS message for session-id:8

Nov 11 08:25:52.702032 radius-access-accept: Redirect-Virtual-Router (Juniper-ERX-VSA) received: default:user-engine-contact

Nov 11 08:25:52.702050 radius-access-accept: Framed-Pool received: nat-v4-pool-1

Nov 11 08:25:52.702065 radius-access-accept: Framed-IPv6-Pool received: ipv6-ia-na-pool-1

Nov 11 08:25:52.702081 radius-access-accept: IPv6-Delegated-Pool-Name (Juniper-ERX-VSA) received: ipv6-dhcpv6-pd-pool-1

Nov 11 08:25:52.702103 radius-access-accept: CoS-Parameter-Type (Juniper-ERX-VSA) received: T02 115M

Nov 11 08:25:52.702121 radius-access-accept: IPv6-Ingress-Policy-Name (Juniper-ERX-VSA) received: ipv6-500m

Nov 11 08:25:52.703005 radius-access-accept: Service-Type received: 2

Nov 11 08:25:52.703028 radius-access-accept: Ingress-Policy-Name (Juniper-ERX-VSA) received: ip-500m

Nov 11 08:25:52.703926 Framework - module(radius) return: SUCCESS

<…>

Nov 11 08:25:52.705329 AuthFsm::current state=AuthStart(1) event=42 astEntry=0x71a9b58 aaa msg=0x5aa49d8 session-id:8

Nov 11 08:25:52.705347 Auth-FSM: Process Auth-Redirect for session-id:8

Nov 11 08:25:52.705363 SdbSyncDriver::request: SDB syn ACK request for sessionId 8

Nov 11 08:25:52.705529 Auth-FSM: GRES-Mirror for session-id:8 state:AuthRedirect(3)

Nov 11 08:25:52.731023 AuthFsm::current state=AuthRedirect(3) event=43 astEntry=0x71a9b58 aaa msg=0x5aa49d8 session-id:8

Nov 11 08:25:52.731038 authd_access_profile_get: profile user-radius-vrf-prod found

Nov 11 08:25:52.731051 ###################################################################

Nov 11 08:25:52.731061 ########################### AUTH REQ RCVD #########################

Nov 11 08:25:52.731072 ###################################################################

Nov 11 08:25:52.731082 Auth-FSM: Process Auth-Request for session-id:8 username <user-ppp> profile <user-radius-vrf-prod>

Nov 11 08:25:52.731094 Auth-FSM: Process Auth-Request for session-id:8

Nov 11 08:25:52.731105 Framework: Starting authentication

Nov 11 08:25:52.731117 authd_access_profile_get: profile user-radius-vrf-prod found

Nov 11 08:25:52.731128 authd_advance_module_for_aaa_request_msg: result:0

Nov 11 08:25:52.731142 Authd module start session-id:8

Nov 11 08:25:52.731152 authd_radius_start_auth: Starting RADIUS authentication session-id:8

Nov 11 08:25:52.731163 authd_radius_get_config: profile user-radius-vrf-prod

Nov 11 08:25:52.731174 authd_radius_get_config: profile user-radius-vrf-prod in arm_profile_radius_tree

Nov 11 08:25:52.731185 authd_radius_get_config:Using radius option config from access profile stanza

Nov 11 08:25:52.731197 authd_access_profile_get: profile user-radius-vrf-prod found

Nov 11 08:25:52.731247 authd_radius_build_basic_auth_request: session-id:8 profile=user-radius-vrf-prod, username=user-ppp

Nov 11 08:25:52.731261 radius-access-request: User-Name added: user-ppp

Nov 11 08:25:52.731272 radius-access-request: User-Password added: ""

Nov 11 08:25:52.731290 Taking a client snapshot, session-id:8

Nov 11 08:25:52.731309 radius-access-request: Service-Type added: 2

Nov 11 08:25:52.731325 radius-access-request: Framed-Protocol added: 1

Nov 11 08:25:52.731344 radius-access-request: Chargeable-User-Identity added:

Nov 11 08:25:52.731366 radius-access-request: Acct-Session-Id added: jnpr ae4.3221225478:8

Nov 11 08:25:52.731388 radius-access-request: Calling-Station-Id added: AVC0001

Nov 11 08:25:52.731407 radius-access-request: DHCP-MAC-Address (Juniper-ERX-VSA) added: 0010.9400.0002

Nov 11 08:25:52.731425 radius-access-request: NAS-Identifier added: host

Nov 11 08:25:52.731443 radius-access-request: NAS-Port added: 00 24 00 01

Nov 11 08:25:52.731460 radius-access-request: NAS-Port-Id added: host:ae4.3221225478:1600-1:AVC0001:1600-1

Nov 11 08:25:52.731476 radius-access-request: NAS-Port-Type added: 15

Nov 11 08:25:52.731498 radius-access-request: Client-Profile-Name (Juniper-ERX-VSA) added: user-engine-ppp-ufb-client:

Nov 11 08:25:52.731517 radius-access-request: PPPoE-Description (Juniper-ERX-VSA) added: pppoe 00:10:94:00:00:02

Nov 11 08:25:52.731548 radius-access-request: 1: Agent-Circuit-Id (DSL Forum-VSA) Sub-Attribute added: circuit 0

Nov 11 08:25:52.731565 radius-access-request: 2: Agent-Remote-Id (DSL Forum-VSA) Sub-Attribute added: AVC0001

<…>

In this particular customer case, the RADIUS server are the same in the default instance and the desired routing-instance.

Customer should use different RADIUS server, and only return the LI related AVPs in the desired routing-instances specified RADIUS server.

Since customer is not actually want to do twice authentication, changing to use Virtual-Router-Name cleared the problem.

The AVPs in the modified Access-Accept message are as following:

DEFAULT User-Name == "ppp-li", Cleartext-Password := "password"

ERX-Virtual-Router-Name = "default:VRF-Sub",