sub-domain
Syntax
sub-domain name {
aaa-logical-system name {
aaa-routing-instance (default | name);
}
target-logical-system name {
target-routing-instance (default | name);
}
access-profile access-profile;
address-pool address-pool;
dynamic-profile dynamic-profile;
override-chap-password override-chap-password;
override-password override-password;
qualifier {
vlan-id-list [ vlan-id-list ... ];
}
strip-domain;
strip-username (left-to-right | right-to-left);
tunnel-profile tunnel-profile;
using-user-password;
}Description
You can configure subdomains under a domain map. Subdomain allows you to select different access-profile for users within the same domain different VLAN ID or VLAN ID range. Subdomain gives the flexibility to differentiate the users in a domain. It provides different services per the profile configuration.
The options available at the domain map level are also available at the subdomain. But the options defined for a subdomain are independent from other subdomains and the options at the domain map level.
Characteristics of a Subdomain
-
Subdomain configuration within a domain takes the higher precedence than the domain map level configuration.
-
The qualifier option is mandatory to define a subdomain.
-
Qualifiers (VLAN ID) cannot have any overlap within a domain.
-
You can configure maximum of 16 subdomains within a domain.
Here're some examples of different types of subdomain configurations and their behavior.
-
Access profile configuration in a domain with VLAN ID qualifier using subdomain.
[edit access domain map abc.com] user@host# set access-profile A user@host# set sub-domain sub1 qualifier vlan-id-list 1 user@host# set sub-domain sub1 access-profile B user@host# set sub-domain sub2 qualifier vlan-id-list [ 11 20 29-35 100-199 ] user@host# set sub-domain sub2 access-profile C user@host# set sub-domain sub3 qualifier vlan-id-list 300-399 user@host# set sub-domain sub3 access-profile D
This configuration creates different access profiles using the VLAN ID qualifier and subdomain.
-
Access profile and strip domain configuration through domain map.
[edit access domain map abc.com] user@host# set access-profile A user@host# set strip-domain user@host# set sub-domain sub1 qualifier vlan-id-list 1 user@host# set sub-domain sub1 access-profile B user@host# set sub-domain sub1 strip-domain user@host# set sub-domain sub2 qualifier vlan-id-list [ 11 20 29-35 100-199 ] user@host# set sub-domain sub2 access-profile C user@host# set sub-domain sub2 strip-domain user@host# set sub-domain sub3 qualifier vlan-id-list 300-399 user@host# set sub-domain sub3 access-profile D user@host# set sub-domain sub3 strip-domain
The intention of this configuration is to use the domain map for an access profile selection, then strip the domain name. For each subdomain you can assign different access profile depending on the VLAN ID, but the
strip-domainkept common for all cases. Though it appears a repeat configuration in subdomain, since the subdomain is totally independent, it gives better flexibility when it comes to assign modifiers selectively. -
Domain map and subdomain configuration for completely independent attribute selection.
[edit access domain map abc.com] user@host# set access-profile A user@host# set strip-domain user@host# set sub-domain sub1 qualifier vlan-id-list 1 user@host# set sub-domain sub1 access-profile B user@host# set sub-domain sub1 strip-domain user@host# set sub-domain sub2 qualifier vlan-id-list [ 11 20 29-35 100-199 ] user@host# set sub-domain sub2 access-profile C user@host# set sub-domain sub2 address-pool user@host# set sub-domain sub3 qualifier vlan-id-list 900-399 user@host# set sub-domain sub3 access-profile D user@host# set sub-domain sub3 dynamic-profile vlan-profile-9xx
For the same domain
abc.com, each subdomain and unqualified domain map (top level) is independently defining its actions. VLAN ID is the qualifier for subdomain, which takes precedence and overrides the unqualified attributes with independent set available in the qualified subdomain. -
Configure an empty subdomain.
[edit access domain map abc.com] user@host# set access-profile A user@host# set strip-domain user@host# set sub-domain sub1 qualifier vlan-id-list [ 100 200-299 400-450 ]
This configuration creates an empty subdomain with a set of VLAN ranges. This configuration is an example to exclude the users of the same domain depending on their VLAN ID.
Any user login qualifying for the subdomain match do not apply any options. All the other non-matching users in the domain get the options from un-qualified top level domain map.
-
Invalid subdomain configuration (overlapping VLAN ID ranges in subdomains).
[edit access domain map abc.com] user@host# set access-profile A user@host# set strip-domain user@host# set sub-domain sub1 qualifier vlan-id-list [ 100 200-299 400-450 ] user@host# set sub-domain sub1 access-profile B user@host# set sub-domain sub1 strip-domain user@host# set sub-domain sub2 qualifier vlan-id-list [ 250-300 ] user@host# set sub-domain sub2 access-profile C user@host# set sub-domain sub2 strip-domain
This configuration gets rejected during commit. The qualifiers within the same domain map cannot have any overlap.
Example of an error message while trying such invalid subdomain configuration commit:
root@host# commit 2021-02-03 22:50:39.730422 IST: Running FIPS Self-tests Veriexec is not enforced, FIPS mode not available 2021-02-03 22:50:39.768595 IST: FIPS Self-tests Skipped [edit access domain map abc.com sub-domain sub2 qualifier] 'vlan-id-list 250-300' Range 250-300 overlaps with range 200-299 in another sub-domain under same domain error: configuration check-out failed
Options
| sub-domain name |
Name of a subdomain. |
| aaa-logical-system |
Logical system used for applying AAA services. |
| aaa-routing-instance |
Routing instance used for applying AAA services.
|
| target-routing-instance |
Specify the routing instance of the subscriber context.
|
| access-profile profile-name |
Name of an access profile. |
| address-pool |
Specify the address pool used to assign addresses to subscribers associated with the domain map. |
| dynamic-profile |
Specify the dynamic profile that is used for subscriber sessions associated with the subdomain. |
| override-chap-password |
Use this CHAP password for authentication. |
| override-password |
Use this password for authentication. |
| strip-domain |
Enable domain name stripping from the username. |
| strip-username |
Enable user name stripping from the username.
|
| tunnel-profile |
Specify the tunnel profile that provides definitions for tunnels associated with the subdomain. |
| using-user-password |
Send overridden CHAP-Password using User-Password. |
Required Privilege Level
access—To view this statement in the configuration.
access-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 21.3R1.