[Contents] [Prev] [Next] [Index] [Report an Error]

Using VSAs for Dynamic IP Interfaces

Table 7 describes the VSAs that apply to dynamic IP interfaces and are supported on a per-user basis from RADIUS. For details, see JUNOSe Link Layer Configuration Guide.

Table 7: VSAs That Apply to Dynamic IP Interfaces

VSA	Description	Type	Length	Subtype	Subtype Length	Value
Ingress-Policy-Name	Specifies the name of the input (ingress) policy	26	len	10	sublen	string: input-policy-name
Egress-Policy-Name	Specifies the name of the output (egress) policy	26	len	11	sublen	string: output-policy-name
Ingress-Statistics	Indicates whether statistics are collected on input	26	12	12	6	integer: 0 – disable, 1 – enable
Egress-Statistics	Indicates whether statistics are collected on output	26	12	13	6	integer: 0 – disable, 1 – enable
QoS-Profile-Name	Specifies the name of the QoS profile to attach to the interface	26	len	26	sublen	string: qos-profile-name

To use the VSAs shown in Table 7:

Specify the policy, or one or more QoS VSAs in the desired RADIUS user entries.
Create the ingress or egress policy, or the QoS profile. Policies minimally consist of one or more policy commands and may include classifier control lists and rate limit profiles. See the JUNOSe Policy Management Configuration Guide for more information about policies and policy routing. See the JUNOSe Quality of Service Configuration Guide for information about creating QoS profiles.

When a dynamic interface is created according to a profile, the router checks with RADIUS to determine whether an input or output policy or a QoS profile must be applied to the interface. The VSA, if present, provides the name, enabling policy or QoS profile lookup. If found, the policy or QoS profile is applied to the dynamic interface.

The router also determines whether the creation profile specifies any policies to be applied to the interface. Policies specified by the RADIUS VSA supersede any specified by the profile, as described in the following example:

The RADIUS user entry includes an Ingress-Policy-Name VSA that specifies the policy input5. The profile specifies two policies, input7 and output1. In this case, the RADIUS-specified input policy (input5) and the profile-specified output policy (output1) are applied to the dynamic interface.

For information about assigning policies via profiles, see the JUNOSe Policy Management Configuration Guide. Only attributes assigned by RADIUS appear in RADIUS Acct-Start messages. RADIUS attributes specified by a profile for dynamic interfaces do not appear in RADIUS Acct-Start messages because the profile is not active when the Acct-Start message is generated. These attributes appear in RADIUS Acct-Stop messages for a profile that is active when the session is terminated.

[Contents] [Prev] [Next] [Index] [Report an Error]