Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

AAA Testing and Troubleshooting

 

AAA Configuration Testing and Troubleshooting

Subscriber management supports a test feature that enables you to check the AAA configuration of a subscriber. You might use the test feature to verify the subscriber’s AAA settings and to help troubleshoot or isolate subscriber login problems. The AAA test process creates a pseudo session that authenticates the subscriber, allocates an address for the subscriber, and issues an accounting start packet. The process then issues an accounting stop request, releases the address, and terminates the pseudo session.

The AAA test results provide details about the attributes that subscriber management assigns to the subscriber during login. The attributes might be assigned by RADIUS, a dynamic profile, static interface configuration, or might be statically assigned. You can test the AAA configuration for DHCP, PPP, and authd-lite subscribers. For L2TP clients, the AAA test process displays all tunnel parameters but does not create an actual tunnel session.

Note

The test aaa commands support all RADIUS-sourced attributes, both IETF standard attributes and Juniper Networks VSAs. Received attributes are displayed in the output. For information about standard RADIUS attributes, see RADIUS IETF Attributes Supported by the AAA Service Framework. For information about Juniper Networks VSAs, see Juniper Networks VSAs Supported by the AAA Service Framework.

Note

The test aaa commands do not support volume-time accounting (Juniper Networks VSA 26-69 with a value of 2). If volume-time accounting is configured for the test subscriber, the test command replaces the statistics with time-only accounting statistics.

Testing a Subscriber AAA Configuration

Purpose

Display the AAA attributes that subscriber management assigns to the subscriber during login.

The following example tests the AAA configuration for a PPP subscriber. You can use the test aaa dhcp user command to perform a similar test for DHCP subscribers and the test aaa authd-lite user command to test authd-lite subscribers.

Action

user@host>test aaa ppp user user45@test.net password $ABC123

You can use the agent-remote-id ari option with the test aaa dhcp user and test aaa ppp user commands to verify DHCP and PPP subscriber authentication in those networks that support the DSL Forum Agent-Remote-Id (VSA 26-2).

If you specify the DSL Forum Agent-Remote-Id, the output includes the specified value. If you do not specify the VSA, then the Agent-Remote-Id value is shown as NULL.

user@host>test aaa ppp user thomastank agent-remote-id “(202)555–1212”

The following example shows output when the authentication grant fails due to an invalid password:

user@host>test aaa ppp user user45@test.net password 55N33%%56

For some networks, such as a Layer 2 network with VLAN-OOB subscribers, RADIUS is configured to provide the subscriber address in a client profile with the Client-Profile-Name VSA (26–174). In the default configuration, the test fails when it does not receive a subscriber address directly from RADIUS. To successfully test these subscribers, you must include the no-address-request option. The command output displays the client profile name in the Dynamic Profile field and the name of the routing instance conveyed by the Virtual-Router VSA (26-1) in the Routing Instance field.

user@host>test aaa ppp user thomastank no-address-request

Starting in Junos OS Release 19.3R1, the XML output format has changed. Each RADIUS server attribute name has an associated attribute value. Each of these pairs is now enclosed by the <radius-server-data> tag. The new tag makes it easier to recognize the name/value pairs, both for operators and API clients.

Note

You may have to change any scripts that use the XML output to work properly with the new format.

The following example shows an excerpt of sample XML output in the old format:

user@host>test aaa ppp user user45@test.net password $ABC123 | display xml

The following example shows an excerpt of sample XML output in the new format:

user@host>test aaa ppp user user45@test.net password $ABC123 | display xml

Related Documentation

Release History Table
Release
Description
Starting in Junos OS Release 19.3R1, the XML output format has changed.