Customer TPG has DHCP dual-stack configured. service-profile DP-POLICER had been returned via RADIUS attribute.
Service-Type = Framed-User,
ERX-Service-Activate:1 = "DP-POLICER(250000000,50000000)",
ERX-Primary-Dns = 1.1.1.1
But once DHCP dual-stack subscriber is bound, the service is not installed.
Type: VLAN
Logical System: default
Routing Instance: default
Interface: demux0.3221225479
Interface type: Dynamic
Underlying Interface: ae12
Dynamic Profile Name: AUTO-STACK-DEMUX
Dynamic Profile Version: 1
State: Active
Session ID: 11
PFE Flow ID: 25
Stacked VLAN Id: 0x8100.2000
VLAN Id: 0x8100.1
Login Time: 2025-04-11 09:09:15 IST
Type: DHCP
User Name: ipoe
IP Address: 1.1.1.5
IP Netmask: 255.255.248.0
Domain name server inet: 1.1.1.1
IPv6 Prefix: 2001:2025:b300:300::/56
Domain name server inet6: 2001:2025:1::1 2001:2025:2::2
IPv6 User Prefix: 2001:2025:b3ff:3::/64
Interface: demux0.3221225480
Underlying Interface: demux0.3221225479
Dynamic Profile Name: DHCP-PROFILE
MAC Address: 00:10:94:00:00:01
Radius Accounting ID: 12
Session ID: 12
PFE Flow ID: 27
Stacked VLAN Id: 2000
VLAN Id: 1
Agent Circuit ID: ipoe
Agent Remote ID: DHCP1
DHCP Options: len 53
35 01 01 39 02 02 40 3d 07 01 00 10 94 00 00 01 33 04 00 00
00 3c 0c 16 63 6c 69 65 6e 74 5f 50 6f 72 74 20 2f 2f 31 30
2f 34 2d 30 2d 30 37 05 01 06 0f 21 2c
DHCPV6 Options: len 69
00 01 00 0e 00 01 00 01 67 f9 01 cb 00 10 94 00 00 01 00 08
00 02 00 00 00 19 00 29 00 00 00 00 00 04 9d 40 00 07 62 00
00 1a 00 19 00 09 3a 80 00 27 8d 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00
DHCP Header: len 44
01 01 06 00 00 08 a0 67 00 00 80 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 10 94 00 00 01 00 00 00 00 00 00
00 00 00 00
DHCPV6 Header: len 4
01 05 90 a9
IP Address Pool: NORMAL
IPv6 Address Pool: V6-LINK-POOL
IPv6 Delegated Address Pool: V6-DHCP-PD-POOL
IPv4 Input Filter Name: peruser-default-in-demux0.3221225480-in
IPv4 Output Filter Name: peruser-default-out-demux0.3221225480-out
IPv6 Input Filter Name: peruser-ipv6-default-in-demux0.3221225480-in
IPv6 Output Filter Name: peruser-ipv6-default-out-demux0.3221225480-out
Access Line Attributes:
Dynamic configuration:
junos-ipv6-ndra-prefix: 2001:2025:b3ff:3::/64
<<<<<<<<<<<< No service session displayed
Customer has on-demand-address-allocation enabled with below configure for DHCPV4/v6 dual-stack single session. The authentication is configured only for DHCPv4 leg.
set system services dhcp-local-server dhcpv6 overrides rapid-commit
set system services dhcp-local-server dhcpv6 overrides client-negotiation-match incoming-interface
set system services dhcp-local-server dhcpv6 overrides delete-binding-on-renegotiation
set system services dhcp-local-server dhcpv6 overrides always-add-option-dns-server
set system services dhcp-local-server dhcpv6 group V6 overrides delegated-pool V6-DHCP-PD-POOL
set system services dhcp-local-server dhcpv6 group V6 overrides dual-stack ds-dhcp
set system services dhcp-local-server dhcpv6 group V6 interface demux0.0
set system services dhcp-local-server dhcpv6 server-duid-type duid_ll
set system services dhcp-local-server duplicate-clients-in-subnet incoming-interface
set system services dhcp-local-server group V4 authentication password *
set system services dhcp-local-server group V4 authentication username-include user-prefix ipoe
set system services dhcp-local-server group V4 overrides client-discover-match incoming-interface
set system services dhcp-local-server group V4 overrides dual-stack ds-dhcp
set system services dhcp-local-server group V4 interface demux0.0
set system services dhcp-local-server dual-stack-group ds-dhcp dynamic-profile DHCP-PROFILE
set system services dhcp-local-server dual-stack-group ds-dhcp on-demand-address-allocation
set system services dhcp-local-server dual-stack-group ds-dhcp classification-key mac-address
set system services dhcp-local-server dual-stack-group ds-dhcp protocol-master inet
Fromt the authd traceoptions log, below can be seen:
Apr 11 08:52:00.649487 Auth-FSM: Process Auth-Request for session-id:9 username <> profile <>
Apr 11 08:52:00.649496 Auth-FSM: Process Reauth-Request for session-id:9 ex_cookie:0x91
Apr 11 08:52:00.649504 Auth-FSM: Process Auth-Request for session-id:9 REAUTH V6
...
Apr 11 08:52:00.651811 SEQ SendClientMsg:jdhcpd-client session-id:9 reply-code=1 (OK), result-subopcode=1 (ACCESS_OK), cookie=65566 ex_cookie=0x91 rply_len=28, num_tlv_blocks=0
Apr 11 08:52:00.651826 authd_auth_aaa_msg_destruct auth_aaa_msg: 0x4e8175c
Apr 11 08:52:00.651838 re-auth in progress, skip loading default service
Apr 11 08:52:00.651847 createDynamicRequest: (3) received
Apr 11 08:52:00.651862 CoARequest CTOR 0x0x753386c
Apr 11 08:52:00.651870 createDynamicRequest: isBulkCoaRequest 0
Apr 11 08:52:00.651878 ServiceAtReauthRequest::findServiceChanges: subscriber session-id:9 has 1 services. Attempt to activate 0 services. ignore LI
Apr 11 08:52:00.651889 ServiceAtReauthRequest Service Plan Change
Apr 11 08:52:00.651906 serviceEntriesExist returns 1 entries
Apr 11 08:52:00.651914 buildAndAddRequest:3297 session-id:9 deactivate DP-POLICER(250000000,50000000)
Apr 11 08:52:00.651956 ServiceDeactivate: DP-POLICER(250000000,50000000)
Apr 11 08:52:00.651970 buildAndAddRequest:3339 Setting sub-session-id:9 - and NO serviceSessionId
If on-demand-address-allocation, no such problem.
Interface: demux0.3221225540
Session ID: 102
PFE Flow ID: 124
Login Time: 2025-04-28 05:45:37 IST
IP Address: 1.1.1.23
Primary DNS Address: 1.1.1.1
IPv6 Address: 2001:2025:bbff:2::6
IPv6 Prefix: 2001:2025:b300:f00::/56
Domain name server inet6: 2001:2025:1::1 2001:44b8:2::2
Interface: demux0.3221225541
Underlying Interface: demux0.3221225540
Radius Accounting ID: 103
Session ID: 103
PFE Flow ID: 126
Service Sessions: 1
DHCP Options: len 54
00 3c 0c 17 63 6c 69 65 6e 74 5f 69 6e 65 74 36 20 2f 2f 31
30 2f 34 2d 30 2d 30 37 05 01 06 0f 21 2c
00 01 00 0e 00 01 00 01 68 09 69 3b 00 10 94 00 00 01 00 08
01 01 06 00 00 08 a5 85 00 00 80 00 00 00 00 00 00 00 00 00
01 05 95 11
IPv6 Address Pool: V6-DHCP-IA-POOL
IPv4 Input Filter Name: peruser-default-in-demux0.3221225541-in
IPv4 Output Filter Name: peruser-default-out-demux0.3221225541-out
IPv6 Input Filter Name: peruser-ipv6-default-in-demux0.3221225541-in
IPv6 Output Filter Name: peruser-ipv6-default-out-demux0.3221225541-out
Service Session ID: 104
Service Session Name: DP-POLICER
Service Session Version: 1
Family: inet, inet6
Service session type: Service-Profile
IPv4 Input Filter Name: INPUT-FILTER-v4_UID1049-demux0.3221225541-in
IPv4 Output Filter Name: OUTPUT-FILTER-v4_UID1051-demux0.3221225541-out
IPv6 Input Filter Name: INPUT-FILTER-v6_UID1052-demux0.3221225541-in
IPv6 Output Filter Name: OUTPUT-FILTER-v6_UID1053-demux0.3221225541-out
Service Activation time: 2025-04-28 05:46:12 IST
INPUT-FILTER-v4: INPUT-FILTER-v4_UID1049
INPUT-FILTER-v6: INPUT-FILTER-v6_UID1052
INPUT-HPOLICER: INPUT-HPOLICER_UID1048
OUTPUT-FILTER-v4: OUTPUT-FILTER-v4_UID1051
OUTPUT-FILTER-v6: OUTPUT-FILTER-v6_UID1053
OUTPUT-HPOLICER: OUTPUT-HPOLICER_UID1050
POLICE-BURST-IN: 5000000
POLICE-BURST-OUT: 3125000
POLICE-RATE-IN: 50000000
POLICE-RATE-OUT: 250000000
The behavior with "on-demand-address-allocation" seen above is expected.
In case of "on-demand-address-allocation", authentication request is initiated by DHCP for v6 stack, instead of just an v6 family activation request when "on-demand-address-allocation" is not configured. If there has no authentication configured for V6 stack, it will go to the default none authentication and no RADIUS attributes presents.
As to the service sessions, when there is a service change, it deactivates all the services for that subscriber whether it is v4 or v6, and applies the attributes based on the present attributes per design.
So irrespective of whether "on-demand-address-allocation" is configured or not, it is better to have authentication stanza configured for both v4 and v6 group.
Customer can configure the authentication in both V4 and V6 group. Customer can also set the authentication under the dual-stack-group stanza like this:
set system services dhcp-local-server dual-stack-group ds-dhcp authentication password *
set system services dhcp-local-server dual-stack-group ds-dhcp authentication username-include user-prefix ipoe