[Contents] [Prev] [Next] [Index] [Report an Error]

Using External AAA Authentication Services

Both the extended DHCP local server and the extended DHCP relay agent support the use of external AAA authentication services, such as RADIUS, to authenticate DHCP clients. When the extended DHCP local server or relay agent receives a discover PDU from a client, the extended DHCP application contacts the AAA server to authenticate the DHCP client. The extended DHCP application can obtain client addresses and DHCP configuration options from the external AAA authentication server.

Note: This section uses the term extended DHCP application to refer to both the extended DHCP local server and the extended DHCP relay agent.

The external authentication feature also supports AAA directed logout. If the external AAA service supports a user logout directive, the extended DHCP application honors the logout and views it as if it was requested by a CLI management command. All of the client state information and allocated resources are deleted at logout. The extended DHCP application supports directed logout using the list of configured authentication servers you specify with the authentication-server statement at the [edit access profile profile-name] hierarchy level.

To configure authentication support for an extended DHCP application, include the authentication statement at these hierarchy levels. You can configure either global authentication support or group-specific support.

You must configure the username-include statement to enable the use of authentication. The password statement is not required and does not cause DHCP to use authentication if the username-include statement is not included.

Extended DHCP local server hierarchies:

Extended DHCP relay agent hierarchies:

authentication {
password password-string;
username-include {
circuit-type;
delimiter delimiter-character;
domain-name domain-name-string;
logical-system-name;
mac-address;
option-60;
option-82 <circuit-id> <remote-id>;
routing-instance-name;
user-prefix user-prefix-string;
}
}

The extended DHCP applications enable you to group together a set of interfaces and apply a common DHCP configuration to the named interface group.

To configure an interface group, use the group statement.

group group-name {
authentication {
password password-string;
username-include {
circuit-type;
delimiter delimiter-character;
domain-name domain-name-string;
logical-system-name;
mac-address;
option-60;
option-82 <circuit-id> <remote-id>;
routing-instance-name;
user-prefix user-prefix-string;
}
}
interface interface-name <upto upto-interface-name> <exclude>;
}

You can specify the names of one or more interfaces on which the extended DHCP application is enabled. You can repeat the interface interface-name statement to specify multiple interfaces within a group, but you cannot specify the same interface in more than one group. For example:

group boston {
interface 192.168.10.1;
interface 192.168.15.5;
}

You can use the upto option to specify a range of interfaces on which the extended DHCP application is enabled. For example:

group quebec {
interface 192.168.10.1 upto 192.168.10.255;
}

You can use the exclude option to exclude a specific interface or a specified range of interfaces from the group. For example:

group paris {
interface 192.168.100.1 exclude;
interface 192.168.100.100 upto 192.168.100.125 exclude;
}

You can configure an optional password that the extended DHCP application presents to the external AAA authentication service to authenticate the specified username.

To configure a password that authenticates the username, use the password statement. See Configuring Special Requirements for Plain-Text Passwords for information about supported characters in passwords. For example:

authentication {
password myPassworD1234
}

You can configure the extended DHCP application to include additional fields in the username passed to the external AAA authentication service when the DHCP client logs in. This additional information enables you to construct usernames that uniquely identify subscribers.

Note: No authentication is performed if you do not include a username in the authentication configuration; however, the IP address is provided by the local pool if it is configured.

To configure unique usernames, use the username-include statement. You can include any or all of the additional statements.

authentication {
username-include {
circuit-type;
delimiter delimiter-character;
domain-name domain-name-string;
logical-system-name;
mac-address;
option-60;
option-82 <circuit-id> <remote-id>;
routing-instance-name;
user-prefix user-prefix-string;
}
}

The following list describes the attributes that can be included as part of the username:

The router creates the unique username by including the specified additional information in the following order, with the fields separated by a delimiter. The default delimiter is a period (.). You can specify a different delimiter; however, the semicolon character (;) is not allowed.

user-prefix[delimiter]mac-address[delimiter]logical-system-name[delimiter]
routing-instance-name[delimiter]circuit-type[delimiter]option-82[delimiter]
option-60@domain-name

This example shows a sample configuration that creates a unique username. The username is shown after the configuration.

Configuration

authentication {
username-include {
circuit-type;
domain-name isp55.com;
mac-address;
user-prefix wallybrown;
}
}

Resulting Unique Username

wallybrown.0090.1a01.1234.enet@isp55.com

When the extended DHCP application receives a response from an external authentication server, the response might include information in addition to the IP address and subnet mask. The extended DHCP application uses the information from the authentication grant for the response the DHCP application sends to the DHCP client. The DHCP application can either send the information in its original form or the application might merge the information with local configuration specifications. For example, if the authentication grant includes an address pool name and a local configuration specifies DHCP attributes for that pool, the extended DHCP application merges the authentication results and the attributes in the reply that the server sends to the client.

A local configuration is optional — a client can be fully configured by the external authentication service. However, if the external authentication service does not provide client configuration, you must configure the local address assignment pool to provide the configuration for the client. When a local configuration specifies options, the extended DHCP application adds the local configuration options to the offer PDU the server sends to the client. If the two sets of options overlap, the options in the authentication response from the external service take precedence.

When you use RADIUS to provide the authentication, the additional information might be in the form of RADIUS attributes and Juniper Networks VSAs. The following list shows the information that RADIUS might include in the authentication grant. See RADIUS Attributes and Juniper Networks VSAs Supported by the AAA Service Framework for a complete list of RADIUS attributes and Juniper Networks VSAs that the extended DHCP applications supports for subscriber access management.

[Contents] [Prev] [Next] [Index] [Report an Error]

Copyright © 2008, Juniper Networks, Inc. All rights reserved. Trademark Notice.