User manual JUNIPER NETWORKS JUNOSE SOFTWARE 11.2.X BROADBAND ACCESS CONFIGURATION GUIDE 7-20-2010

[. . . ] JunosETM Software for E SeriesTM Broadband Services Routers Broadband Access Configuration Guide Release 11. 2. x Published: 2010-07-20 Copyright © 2010, Juniper Networks, Inc. Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, California 94089 USA 408-745-2000 www. juniper. net Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. [. . . ] To set a baseline for RADIUS relay statistics: · Issue the baseline radius relay command: host1#baseline radius relay There is no no version. Related Topics · · Monitoring RADIUS Relay Server Statistics on page 306 baseline radius relay Monitoring RADIUS Relay Server Statistics Purpose Action Display RADIUS relay server statistics. To show RADIUS relay server statistics that were baselined: host1#show radius relay statistics delta RADIUS Relay Authentication Server Statistics --------------------------------------------Statistic Total ---------------------Access Requests 1000 Access Accepts 1000 Access Challenges 0 Access Rejects 0 Pending Requests 0 Duplicate Requests 0 Malformed Requests 0 Bad Authenticators 0 Unknown Requests 0 306 Copyright © 2010, Juniper Networks, Inc. Chapter 8: Monitoring RADIUS Dropped Packets 0 Invalid Requests 0 Statistics baseline set FRI APR 02 2004 19:01:52 UTC RADIUS Relay Accounting Server Statistics ----------------------------------------Statistic Total -----------------------Accounting Requests 1000 Start 1000 Stop 0 Interim 0 Accounting Responses 1000 Start 1000 Stop 0 Interim 0 Pending Requests 0 Duplicate Requests 0 Malformed Requests 0 Bad Authenticators 0 Unknown Requests 0 Dropped Packets 0 Invalid Requests 0 Statistics baseline set FRI APR 02 2004 19:01:52 UTC Meaning Table 61 on page 307 lists the show radius relay statistics command output fields. Table 61: show radius relay statistics Output Fields Field Name Access Requests Access Accepts Access Challenges Access Rejects Pending Requests Duplicate Requests Field Description Number of access requests received Number of access accepts received Number of access challenges received Number of access rejects received Number of access requests waiting for a response Number of duplicate requests received while the previous request is pending Requests with attributes having an invalid length or unexpected attributes Authenticator in the response is incorrect for the matching request; can occur if the secret for the RADIUS relay server and the WAP does not match Packets received from nonconfigured clients Packets dropped because of queue overflow Number of invalid requests received Malformed Requests Bad Authenticators Unknown Requests Dropped Packets Invalid Requests Copyright © 2010, Juniper Networks, Inc. 307 JunosE 11. 2. x Broadband Access Configuration Guide Table 61: show radius relay statistics Output Fields (continued) Field Name Accounting Requests Field Description Number of accounting requests received, broken down by type of request Number of accounting responses, broken down by type of request Accounting Responses Related Topics · · Setting a Baseline for RADIUS Relay Statistics on page 306 show radius relay statistics Monitoring the Configuration of the RADIUS Relay Server Purpose Action Display information about the RADIUS relay server configuration. To display the RADIUS relay server configuration: host1#show radius relay servers RADIUS Relay Authentication Server Configuration -----------------------------------------------IP Address IP Mask Secret ----------------------------------10. 10. 8. 15 255. 255. 255. 255 newsecret 192. 168. 102. 5 255. 255. 255. 255 999Y2K Udp Port: 1812 RADIUS Relay Accounting Server Configuration -------------------------------------------IP Address IP Mask Secret --------------------------------10. 10. 1. 0 255. 255. 255. 0 NO8pxq 192. 168. 102. 5 255. 255. 255. 255 12BE$56 Udp Port: 1813 Meaning Table 62 on page 308 lists the show radius relay servers command output fields. Table 62: show radius relay servers Output Fields Field Name IP Address IP Mask Secret Field Description Address of the RADIUS relay server Mask of the RADIUS relay server Secret used for exchanges between the RADIUS relay server and client Router's port on which the RADIUS relay server listens Udp Port Related Topics · show radius relay servers 308 Copyright © 2010, Juniper Networks, Inc. Chapter 8: Monitoring RADIUS Monitoring the Status of RADIUS Relay UDP Checksums Purpose Action Display status of RADIUS relay UDP checksums. To display the status of UDP checksums: host1(config)#show radius relay udp-checksum udp-checksums enabled Meaning Table 63 on page 309 lists the show radius relay udp-checksum command output fields. Table 63: show radius relay udp-checksum Output Fields Field Name udp-checksums Field Description Status of UDP checksums: enabled or disabled Related Topics · show radius relay udp-checksum Monitoring the Status of ICR Partition Accounting Purpose Action Display the status of ICR partition accounting. To display the status of ICR partition accounting: host1#show radius icr-partition-accounting enabled Meaning ICR partition accounting status is either enabled or disabled. Related Topics · show radius icr-partition-accounting Copyright © 2010, Juniper Networks, Inc. 309 JunosE 11. 2. x Broadband Access Configuration Guide 310 Copyright © 2010, Juniper Networks, Inc. CHAPTER 9 Configuring TACACS+ This chapter explains how to enable and configure TACACS+ in your E Series router. It has the following sections: · · · · · TACACS+ Overview on page 311 TACACS+ Platform Considerations on page 315 TACACS+ References on page 315 Before You Configure TACACS+ on page 315 Configuring TACACS+ Support on page 316 TACACS+ Overview With the increased use of remote access, the need for managing more network access servers (NAS) has increased. Additionally, the need for control access on a per-user basis has escalated, as has the need for central administration of users and passwords. Terminal Access Controller Access Control System (TACACS) is a security protocol that provides centralized validation of users who are attempting to gain access to a router or NAS. TACACS+, a more recent version of the original TACACS protocol, provides separate authentication, authorization, and accounting (AAA) services. NOTE: TACACS+ is a completely new protocol and is not compatible with TACACS or XTACACS. The TACACS+ protocol provides detailed accounting information and flexible administrative control over the authentication, authorization, and accounting process. The protocol allows a TACACS+ client to request detailed access control and allows the TACACS + process to respond to each component of that request. TACACS+ uses Transmission Control Protocol (TCP) for its transport. TACACS+ provides security by encrypting all traffic between the NAS and the process. Encryption relies on a secret key that is known to both the client and the TACACS+ process. Table 64 on page 312 describes terms that are frequently used in this chapter. Copyright © 2010, Juniper Networks, Inc. 311 JunosE 11. 2. x Broadband Access Configuration Guide Table 64: TACACS-Related Terms Term NAS Description Network access server. A device that provides connections to a single user, to a network or subnetwork, and to interconnected networks. In reference to TACACS+, the NAS is the E Series router. A program or software running on a security server that provides AAA services using the TACACS+ protocol. The program processes authentication, authorization, and accounting requests from an NAS. When processing authentication requests, the process might respond to the NAS with a request for additional information, such as a password. The security server on which the TACACS+ process is running. Also referred to as a TACACS+ server. TACACS+ process TACACS+ host AAA Overview TACACS+ allows effective communication of AAA information between NASs and a central server. [. . . ] See DSLs disable proxy lcp command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370 Disconnect-Cause (RADIUS attribute 26-51). . . . . . . . . . . . 218 Disconnect-Request messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 DNIS (dialed number identification service). . . . . . . . 9, 370 DNS (Domain Name System) assigning IP addresses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 DNS addresses order of preference in allocation to clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Copyright © 2010, Juniper Networks, Inc. 721 JunosE 11. 2. x Broadband Access Configuration Guide DNS domain names list of configured in IPv6 local address pools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 order of preference in responses to clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 DNS domains configuring more than one using the CLI interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 in IPv6 local address pools processing client requests for resolution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 in responses to clients Domain Search List option and. . . . . . . . . . . . . . . . . . . . . 105 maximum number in IPv6 local address pools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 DNS Recursive Name Search option DHCPv6 server responses and DNS servers in local pools. . . . . . . . . . . . . . . . . . . . . . 105 DNS servers addresses in responses to clients DNS Recursive Name Search option and. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 configuring in IPv6 local address pools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 list of configured in IPv6 address pools. . . . . . . . . . . . . . . . . . 103 order of preference in responses to clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 order of use for delegating prefixes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 primary and secondary for domain resolution requests from clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 responding with IPv6 addresses for client requests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 documentation set comments on. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxvii domain command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 572 Domain Name System. See DNS domain names allowing or denying. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 configuring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 mapping to virtual routers. . . . . . . . . . . . . . . . . . . 8, 115, 124, 417 mapping user requests without domain name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8, 9 none. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 specifying single name for users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 stripping domain name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 using aliases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 using delimiters other than @. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 using either domain or realm asdomain name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 using realm name as domain name. . . . . . . . . . . . . . . . . . . . . . . . . 11 Downstream-Calculated-QoS-Rate (RADIUS attribute 26-141). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 DSL Forum VSAs controlling inclusion of. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 descriptions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 in AAA access and accounting messages. . . . . . . . . . 182 DSLAMs (digital subscriber line access multiplexers). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 DSLs (digital subscriber lines). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 dual stack combined IPv4 and IPv6 services example of . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 682 IPv4 and IPv6 services combined, activating and deactivating. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652 combined, overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650 independent, activating and deactivating. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652 independent, overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650 service interim accounting, overview. . . . . . . . . 658 Service manager support, activating and deactivating. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652 Service manager support, overview. . . . . . . . . . . 650 statistics collection external parent groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670 duplicate AAA accounting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 configuring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 duplicate clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468 duplicate MAC addresses identifying DHCP clients with. . . . . . . . . . . . . . . . . . . . . . . . 514, 522 monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 Dynamic Host Configuration Protocol. See DHCP See DHCP dynamic IP interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 dynamic subscriber interfaces commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 configuring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592, 603 configuring DHCP external server to interoperate with DHCP relay and DHCP relay proxy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 520 configuring DHCP external server to preserve. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513, 519 722 Copyright © 2010, Juniper Networks, Inc. Index configuring DHCP external server to re-authenticate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523 DHCP server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592 framed routes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 595 GRE tunnel configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 in same VR as DHCP relay. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592 inheriting MAC validation state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 595 IP over bridged Ethernet configuration. . . . . . . . . . . . . . . 605 IP over Ethernet configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603 IP over VLAN over Ethernet configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604 monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617 overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592 packet detection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 594 external parent groups combined IPv4 and IPv6 services with example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 682 statistics collection for setting up. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670 F fixed format Calling Number AVP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343 fragmentation and reassembly. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 packet. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331 framed routes dynamic subscriber interfaces. . . . . . . . . . 595 Framed-Compression (RADIUS attribute 13). . . . . . . . . . . . 189 Framed-Interface-Id (RADIUS attribute 96). . . . . . . . . . . . 208 Framed-Ip-Address (RADIUS attribute 8). . . . . . . . . . . . . . . . . . 188 Framed-Ip-Netmask (RADIUS attribute 9). . . . . . . . . . . . . . . . 188 Framed-Ipv6-Pool (RADIUS attribute 100). . . . . . . . . . . . . . . 210 Framed-Ipv6-Prefix (RADIUS attribute 97). . . . . . . . . . . . . . 209 Framed-IPv6-Prefix attribute used for DHCPv6 Prefix Delegation from Access-Accept messages. . . . . . . . . . . . . . . . . . . . . . . 87 Framed-Ipv6-Route (RADIUS attribute 99). . . . . . . . . . . . . 209 Framed-MTU (RADIUS attribute 12). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 E E120 and E320 routers ATM interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591 EAP (Extensible Authentication Protocol) external RADIUS server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 local authentication server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 RADIUS attributes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 RADIUS authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 TACACS+ server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 EAP-Message (RADIUS attribute 79). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Egress-Policy-Name (RADIUS attribute 26-11). . . . . . . . . 213 enable proxy authenticate command. . . . . . . . . . . . . . . . . . . . . . . . . . 370 encapsulation commands encapsulation bridge1483. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 encapsulation vlan. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 endpoint discriminator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 equal-access DHCP local server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458 Ethernet configuring dynamic subscriber interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603 Ethernet interfaces commands interface tenGigabitEthernet. . . . . . . . . . . . . . . . . . . . . . . . 609 Ethernet links between CPE and PE routers pool section for Prefix Delegation. . . . . . . . . . . . . . . . . 107 Event-Timestamp (RADIUS attribute 55). . . . . . . . . . . . . . . . . . 201 exclusion ranges configuring for delegation of prefixes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 example for non-PPP client requests. . . . . . . . . . . . . . . . . . 107 for DHCPv6 prefixes delegated to clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Extensible Authentication Protocol. See EAP G giaddr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459, 483 GRE (Generic Routing Encapsulation) tunnels dynamic subscriber interfaces. . . . . . . . . . . . . . . . . . . . . . . . . 594, 607 guided entrance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624, 674 CoA-Request messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675 H HTTP local server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675, 677 guided entrance service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 Service Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 I I/O adapters. [. . . ]