配置 AGF 的 PPP 支持
此示例介绍如何配置接入网关功能 (AGF), 以支持订阅者使用以太网点对点协议 (PPPoE) 进行身份验证。
程序
CLI 快速配置
要快速配置此示例,请复制以下命令,将其粘贴到文本文件中,删除所有换行符,更改详细信息,以便与网络配置匹配,然后将命令复制并粘贴到层级的 [edit]
CLI 中。
set dynamic-profiles autoconf-vlan-demux routing-instances "$junos-routing-instance" interface "$junos-interface-name" any set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" ppp-options chap set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" ppp-options pap set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" ppp-options aaa-options nas-5g-access-options set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" pppoe-options underlying-interface "$junos-underlying-interface" set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" pppoe-options server set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" no-keepalives set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" family inet unnumbered-address "$junos-loopback-interface" set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" family inet6 unnumbered-address "$junos-loopback-interface" set access profile NAS-5G-AGF authentication-order nas-5g set access nas-5g max-outstanding-requests 1000 set access nas-5g request-retry 3 set access nas-5g timeout 30 set access aaa-options NAS-5G-ACCESS-OPTIONS access-profile NAS-5G-AGF set access aaa-options NAS-5G-ACCESS-OPTIONS aaa-context AMF-RI set access aaa-options NAS-5G-ACCESS-OPTIONS subscriber-context UE-RI-1 set access domain map DOMAIN1.COM aaa-routing-instance AMF-RI set access domain map DOMAIN1.COM access-profile nas-5g-agf set access domain map DOMAIN1.COM target-routing-instance UE-RI-1 set routing-instances UE-RI-1 instance-type virtual-router set routing-instances UE-RI-1 interface xe-2/0/1.3 set routing-instances UE-RI-1 interface lo0.1
逐步过程
-
为点对点协议 (PPP) 订阅者配置动态配置文件。
[edit] user@host# set dynamic-profiles autoconf-vlan-demux routing-instances "$junos-routing-instance" interface "$junos-interface-name" any user@host# set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" ppp-options chap user@host# set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" ppp-options pap user@host# set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" ppp-options aaa-options nas-5g-access-options user@host# set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" pppoe-options underlying-interface "$junos-underlying-interface" user@host# set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" pppoe-options server user@host# set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" no-keepalives user@host# set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" family inet unnumbered-address "$junos-loopback-interface" user@host# set dynamic-profiles autoconf-vlan-demux interfaces pp0 unit "$junos-interface-unit" family inet6 unnumbered-address "$junos-loopback-interface"
-
为订阅者组设置访问身份验证方法,以使用非接入层 (NAS) 信令。
[edit] user@host# set access profile NAS-5G-AGF authentication-order nas-5g
-
为 AGF 和 AMF 之间的 NAS 信令配置以下选项。
-
最大未完成请求数 — 来自 AMF 的未回复请求消息数。
-
重试次数 — 注册或取消注册请求的尝试次数。
-
超时 — AGF 等待 AMF 响应的持续时间。
[edit] user@host# set access nas-5g max-outstanding-requests 1000 user@host# set access nas-5g request-retry 3 user@host# set access nas-5g timeout 30
-
-
执行以下步骤,使用一组 AAA 选项为 PPP 订阅者定义配置文件:
-
为订阅者组创建访问配置文件 (
access-profile
)。 - 指定订阅者会话用于 AAA (RADIUS) 交互的逻辑系统:路由实例 (LS:RI)。
- 指定用户接口所在的 LS:RI。在本案例中,我们使用默认路由实例
[edit] user@host# set access aaa-options NAS-5G-ACCESS-OPTIONS access-profile NAS-5G-AGF user@host# set access aaa-options NAS-5G-ACCESS-OPTIONS aaa-context AMF-RI user@host# set access aaa-options NAS-5G-ACCESS-OPTIONS subscriber-context UE-RI-1
或者,您可以创建域映射,并将该域映射应用于访问配置文件。
[edit] user@host# set access domain map DOMAIN1.COM aaa-routing-instance AMF-RI user@host# set access domain map DOMAIN1.COM access-profile NAS-5G-AGF user@host# set access domain map DOMAIN1.COM target-routing-instance UE-RI-1
-
-
配置路由实例。
[edit] user@host# set routing-instances UE-RI-1 instance-type virtual-router user@host# set routing-instances UE-RI-1 interface xe-2/0/1.3 user@host# set routing-instances UE-RI-1 interface lo0.1
有关 PPP 订阅者的更多信息,请参阅 https://www.juniper.net/documentation/us/en/software/junos/subscriber-mgmt-access/topics/topic-map/ppp-access-network-overview.html