Configuring an AAA Profile
An AAA profile is a collection of attributes to specify how a router interacts with RADIUS servers that control the activation and deactivation of policy and charging control (PCC) rules.
Before you configure an AAA profile, you must do the following:
Configure the network elements that are to be included in the AAA profile.
To configure an AAA profile:
- Configure a name for the AAA profile.
[edit unified-edge aaa] user@host# set profiles aaa-profile-name
- Specify the network element providing policy management
for TDF subscribers.
[edit unified-edge aaa profiles aaa-profile-name radius authentication] user@host# set network-element network-element-name
- If the RADIUS servers in the network element providing
policy management for TDF subscribers cannot initiate a change of
authorization (CoA) request without an accounting record, specify
that the network element is used for accounting.
[edit unified-edge aaa profiles aaa-profile-name radius accounting] user@host# set network-element network-element-name
-
If the RADIUS servers in the network element providing policy management for
TDF subscribers cannot initiate a CoA request without an accounting record,
enable the initiation of a RADIUS accounting start from the router to the RADIUS
servers.
[edit unified-edge aaa profiles aaa-profile-name radius policy] user@host# set coa-accounting enable
-
Configure the RADIUS attribute that you want to carry the PCC rulebase name for
rulebase activations from the RADIUS policy server to the router. By default,
the rulebase name is carried in the ERX-Service-Activate Juniper vendor-specific
attribute (VSA).
Specify the numeric value for the RADIUS AVP.
[edit unified-edge aaa profiles aaa-profile-name radius policy activation-attribute] user@host# set code numeric-code
If the RADIUS AVP is vendor-specific, specify the vendor identification.
[edit unified-edge aaa profiles aaa-profile-name radius policy activation-attribute] user@host# set vendor-id vendor-id
-
Configure the RADIUS attribute that you want to carry the PCC rulebase name for
rulebase deactivations from the RADIUS policy server to the router. By default,
the rulebase name is carried in the ERX-Service-Deactivate Juniper VSA.
Specify the numeric value for the RADIUS AVP.
[edit unified-edge aaa profiles aaa-profile-name radius policy deactivation-attribute] user@host# set code numeric-code
If the RADIUS AVP is vendor-specific, specify the vendor identification.
[edit unified-edge aaa profiles aaa-profile-name radius policy deactivation-attribute] user@host# set vendor-id vendor-id