User manual JUNIPER NETWORKS JUNOSE SOFTWARE 11.1.X BROADBAND ACCESS CONFIGURATION GUIDE 6-6-2010

[. . . ] JUNOSeTM Software for E SeriesTM Broadband Services Routers Broadband Access Configuration Guide Release 11. 1. x Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, California 94089 USA 408-745-2000 www. juniper. net Published: 2010-04-06 Juniper Networks, the Juniper Networks logo, JUNOS, NetScreen, ScreenOS, and Steel-Belted Radius are registered trademarks of Juniper Networks, Inc. in the United States and other countries. JUNOSe is a trademark of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. [. . . ] Verify the L2TP tunnel configuration. host1(config)# show aaa domain-map Domain: westford. com; router-name: default; ipv6-router-name: default Tunnel Tag -----3 Tunnel Tag -----3 Tunnel Tunnel Tunnel Tunnel Tunnel Tunnel Peer Source Type Medium Password Id ---------------------------------------- -----192. 168. 2. 13 192. 168. 3. 3 l2tp ipv4 temporary acton Tunnel Tunnel Tunnel Server Tunnel Max Virtual Name Preference Sessions Tunnel RWS Router ----------------------------------------boston 5 0 system chooses vr2 Tunnel Client Name -----host4 host1#show aaa tunnel-parameters Tunnel password is 3&92k%b#q4 Tunnel client-name is <NULL> Tunnel nas-port-method is none Tunnel nas-port ignore disabled Tunnel nas-port-type ignore disabled Tunnel assignmentId format is assignmentId Tunnel calling number format is descriptive Related Topics Mapping User Domain Names to L2TP Tunnels from Tunnel Group Tunnel Mode on page 363 aaa domain-map aaa tunnel assignment-id-format aaa tunnel client-name aaa tunnel ignore aaa tunnel password address client-name command identification command l2tp disable challenge l2tp ignore-receive-data-sequencing medium ipv4 command password command preference command router-name 362 Mapping User Domain Names to L2TP Tunnels from Domain Map Tunnel Mode Chapter 12: Configuring an L2TP LAC server-name source-address tunnel tunnel group type Mapping User Domain Names to L2TP Tunnels from Tunnel Group Tunnel Mode To map a domain to an L2TP tunnel locally on the router from Tunnel Group Tunnel Configuration mode, perform the following steps: 1. Specify an AAA tunnel group and change the mode to Tunnel Group Tunnel Configuration mode. From Tunnel Group Tunnel Configuration mode, you can add up to 31 tunnel definitions. host1(config)#aaa tunnel-group westford host1(config-tunnel-group)# 2. Specify a tunnel to configure and enter Tunnel Group Tunnel Configuration mode: host1(config-tunnel-group)#tunnel 3 host1(config-tunnel-group-tunnel)# 3. Specify a virtual router; in this case, the default router is specified. host1(config-tunnel-group-tunnel)#router-name default 4. Specify the LNS endpoint address of a tunnel. host1(config-tunnel-group-tunnel)#address 192. 0. 2. 13 5. Specify a preference for the tunnel. You can specify up to eight levels of preference, and you can assign the same preference to a maximum of 31 tunnels. When you define multiple preferences for a destination, you increase the probability of a successful connection. host1(config-tunnel-group-tunnel)#preference 5 6. (Optional) Specify an authentication password for the tunnel. host1(config-tunnel-group-tunnel)#password temporary NOTE: If you specify a password for the LAC, the router requires that the peer (the LNS) authenticate itself to the router. In this case, if the peer fails to authenticate itself, the tunnel terminates. (Optional) Specify a hostname for the LAC end of the tunnel. 7. Mapping User Domain Names to L2TP Tunnels from Tunnel Group Tunnel Mode 363 JUNOSe 11. 1. x Broadband Access Configuration Guide The LAC sends the hostname to the LNS when communicating to the LNS about the tunnel. The hostname can be up to 64 characters (no spaces). host1(config-tunnel-group-tunnel)#client-name host4. NOTE: If the LNS does not accept tunnels from unknown hosts, and if no hostname is specified, the LAC uses the router name as the hostname. (Optional) Specify a server name for the LNS. This name specifies the hostname expected from the peer (the LNS) when you set up a tunnel. When this name is specified, the peer must identify itself with this name during tunnel startup. The server name can be up to 64 characters (no spaces). host1(config-tunnel-group-tunnel)#server-name boston 9. 8. (Optional) Specify a source IP address for the LAC tunnel endpoint. All L2TP packets sent to the peer use this source address. By default, the router uses the virtual router's router ID as the source address. You can override this behavior for an L2TP tunnel by specifying a source address. If you do specify a source address, use the address of a stable IP interface (for example, a loopback interface). Make sure that the address is configured in the virtual router for this domain map, and that the address is reachable by the peer. host1(config-tunnel-group-tunnel)#source-address 192. 0. 3. 3 10. Specify a tunnel identification. host1(config-tunnel-group-tunnel)#identification acton The router groups L2TP sessions with the same tunnel identification into the same tunnel. This occurs only when both the destination (virtual router, IP address) and the ID are the same. 11. (L2TP supports only IP version 4 [IPv4]. ) host1(config-tunnel-group-tunnel)#medium ipv4 12. Specify the L2TP tunnel type (RADIUS attribute 64, Tunnel-Type). Currently, the only supported value is L2TP. host1(config-tunnel-group-tunnel)#type l2tp 13. Verify the L2TP tunnel configuration. host1(config)# show aaa domain-map Domain: westford. com; router-name: default; ipv6-router-name: default Tunnel Tag -----3 Tunnel Peer -----------192. 168. 2. 13 Tunnel Tunnel Source ----------192. 168. 3. 3 Tunnel Tunnel Type -----l2tp Tunnel Medium -----ipv4 Tunnel Password --------temporary Tunnel Tunnel Id -----acton Tunnel Client Name -----host4 364 Mapping User Domain Names to L2TP Tunnels from Tunnel Group Tunnel Mode Chapter 12: Configuring an L2TP LAC Tunnel Tag -----3 Server Name -----boston Tunnel Preference ---------5 Max Sessions -------0 Tunnel RWS -------------system chooses Virtual Router ------vr2 host1#show aaa tunnel-parameters Tunnel password is 3&92k%b#q4 Tunnel client-name is <NULL> Tunnel nas-port-method is none Tunnel nas-port ignore disabled Tunnel nas-port-type ignore disabled tunnel assignmentId format is assignmentId aaa tunnel calling number format is descriptive Related Topics Mapping User Domain Names to L2TP Tunnels from Domain Map Tunnel Mode on page 359 aaa tunnel-group address client-name command identification command medium ipv4 command password command preference command router-name server-name source-address tunnel type Configuring the RX Speed on the LAC You can configure the E Series LAC to always generate L2TP Receive (RX) Speed AVP 38. [. . . ] See DSLs disable proxy lcp command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 Disconnect-Cause (RADIUS attribute 26-51). . . . . . . . . . . . . . . 227 Disconnect-Request messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 DNIS (dialed number identification service). . . . . . . . . . . 9, 378 DNS (Domain Name System) assigning IP addresses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 DNS addresses order of preference in allocation to clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 DNS domain names list of configured in IPv6 local address pools. . . . . . . . . 106 order of preference in responses to clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 740 Index Index DNS domains configuring more than one using the CLI interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 in IPv6 local address pools processing client requests for resolution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 in responses to clients Domain Search List option and. . . . . . . . . . . . . . . . . . . . 108 maximum number in IPv6 local address pools. . . . . . . . . . . . . . . . . . . . . . . . . . . 108 DNS Recursive Name Search option DHCPv6 server responses and DNS servers in local pools. . . . . . . . . . . . . . . . . . . . . 108 DNS servers addresses in responses to clients DNS Recursive Name Search option and. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 configuring in IPv6 local address pools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 list of configured in IPv6 address pools. . . . . . . . . . . . . . . . . 106 order of preference in responses to clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 order of use for delegating prefixes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 primary and secondary for domain resolution requests from clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 responding with IPv6 addresses for client requests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 documentation set comments on. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxix domain command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588 Domain Name System. See DNS domain names allowing or denying. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 configuring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 mapping to virtual routers. . . . . . . . . . . . . . 8, 119, 129, 428 mapping user requests without domain name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8, 9 none. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 specifying single name for users. . . . . . . . . . . . . . . . . . . . . . . . . . . 16 stripping domain name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 using aliases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 using delimiters other than @. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 using either domain or realm asdomain name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 using realm name as domain name. . . . . . . . . . . . . . . . . . . . . . 12 Downstream-Calculated-QoS-Rate (RADIUS attribute 26-141). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 DSL Forum VSAs controlling inclusion of. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 descriptions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276 in AAA access and accounting messages. . . . . . . . . . . . 188 DSLAMs (digital subscriber line access multiplexers). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 DSLs (digital subscriber lines). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 dual stack combined IPv4 and IPv6 services example of . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 702 IPv4 and IPv6 services combined, activating and deactivating. . . . . . . . . 670 combined, overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 669 independent, activating and deactivating. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670 independent, overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 669 service interim accounting, overview. . . . . . . . . . . 676 Service manager support, activating and deactivating. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670 Service manager support, overview. . . . . . . . . . . . . 669 statistics collection external parent groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 duplicate AAA accounting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 configuring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 duplicate clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480 duplicate MAC addresses identifying DHCP clients with. . . . . . . . . . . . . . . . . . . . . 526, 536 monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555 Dynamic Host Configuration Protocol. See DHCP See DHCP dynamic IP interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 dynamic subscriber interfaces commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627 configuring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610, 622 configuring DHCP external server to interoperate with DHCP relay and DHCP relay proxy . . . . . . . . . 533 configuring DHCP external server to preserve. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525, 532 configuring DHCP external server to re-authenticate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537 DHCP server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610 framed routes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 613 GRE tunnel configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625 in same VR as DHCP relay. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610 inheriting MAC validation state. . . . . . . . . . . . . . . . . . . . . . . . . . . 613 IP over bridged Ethernet configuration. . . . . . . . . . . . . . . 624 IP over Ethernet configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . 622 IP over VLAN over Ethernet configuration. . . . . . . . . . . 623 monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635 overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610 packet detection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612 E E120 and E320 routers ATM interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 EAP (Extensible Authentication Protocol) external RADIUS server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 local authentication server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 RADIUS attributes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Index 741 JUNOSe 11. 1. x Broadband Access Configuration Guide RADIUS authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 TACACS+ server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 EAP-Message (RADIUS attribute 79). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Egress-Policy-Name (RADIUS attribute 26-11). . . . . . . . . . . . 221 enable proxy authenticate command. . . . . . . . . . . . . . . . . . . . . . . . . 378 encapsulation commands encapsulation bridge1483. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627 encapsulation vlan. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627 endpoint discriminator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382 equal-access DHCP local server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 Ethernet configuring dynamic subscriber interfaces. . . . . . . . . . 622 Ethernet interfaces commands interface tenGigabitEthernet. . . . . . . . . . . . . . . . . . . . . . . . 627 Ethernet links between CPE and PE routers pool section for Prefix Delegation. . . . . . . . . . . . . . . . 110 Event-Timestamp (RADIUS attribute 55). . . . . . . . . . . . . . . . . . . . 209 exclusion ranges configuring for delegation of prefixes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 example for non-PPP client requests. . . . . . . . . . . . . . . . . . . 110 for DHCPv6 prefixes delegated to clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Extensible Authentication Protocol. See EAP external parent groups combined IPv4 and IPv6 services with example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 702 statistics collection for setting up. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 GRE (Generic Routing Encapsulation) tunnels dynamic subscriber interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612, 625 guided entrance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 642, 693 CoA-Request messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 694 H HTTP local server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 694, 696 guided entrance service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 696 Service Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 696 I I/O adapters. [. . . ]