Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

AAA Testing and Troubleshooting

AAA Configuration Testing and Troubleshooting

Subscriber management supports a test feature that enables you to check the AAA configuration of a subscriber. You might use the test feature to verify the subscriber’s AAA settings and to help troubleshoot or isolate subscriber login problems. The AAA test process creates a pseudo session that authenticates the subscriber, allocates an address for the subscriber, and issues an accounting start packet. The process then issues an accounting stop request, releases the address, and terminates the pseudo session.

The AAA test results provide details about the attributes that subscriber management assigns to the subscriber during login. The attributes might be assigned by RADIUS, a dynamic profile, static interface configuration, or might be statically assigned. You can test the AAA configuration for DHCP, PPP, and authd-lite subscribers. For L2TP clients, the AAA test process displays all tunnel parameters but does not create an actual tunnel session.

Note:

The test aaa commands support all RADIUS-sourced attributes, both IETF standard attributes and Juniper Networks VSAs. Received attributes are displayed in the output. For information about standard RADIUS attributes, see RADIUS IETF Attributes Supported by the AAA Service Framework. For information about Juniper Networks VSAs, see Juniper Networks VSAs Supported by the AAA Service Framework.

Note:

The test aaa commands do not support volume-time accounting (Juniper Networks VSA 26-69 with a value of 2). If volume-time accounting is configured for the test subscriber, the test command replaces the statistics with time-only accounting statistics.

Testing a Subscriber AAA Configuration

Purpose

Display the AAA attributes that subscriber management assigns to the subscriber during login.

The following example tests the AAA configuration for a PPP subscriber. You can use the test aaa dhcp user command to perform a similar test for DHCP subscribers and the test aaa authd-lite user command to test authd-lite subscribers.

Action

You can use the agent-remote-id ari option with the test aaa dhcp user and test aaa ppp user commands to verify DHCP and PPP subscriber authentication in those networks that support the DSL Forum Agent-Remote-Id (VSA 26-2).

If you specify the DSL Forum Agent-Remote-Id, the output includes the specified value. If you do not specify the VSA, then the Agent-Remote-Id value is shown as NULL.

The following example shows output when the authentication grant fails due to an invalid password:

For some networks, such as a Layer 2 network with VLAN-OOB subscribers, RADIUS is configured to provide the subscriber address in a client profile with the Client-Profile-Name VSA (26–174). In the default configuration, the test fails when it does not receive a subscriber address directly from RADIUS. To successfully test these subscribers, you must include the no-address-request option. The command output displays the client profile name in the Dynamic Profile field and the name of the routing instance conveyed by the Virtual-Router VSA (26-1) in the Routing Instance field.

Starting in Junos OS Release 19.3R1, the XML output format has changed. Each RADIUS server attribute name has an associated attribute value. Each of these pairs is now enclosed by the <radius-server-data> tag. The new tag makes it easier to recognize the name/value pairs, both for operators and API clients.

Note:

You may have to change any scripts that use the XML output to work properly with the new format.

The following example shows an excerpt of sample XML output in the old format:

The following example shows an excerpt of sample XML output in the new format:

Change History Table

Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.

Release
Description
19.3R1
Starting in Junos OS Release 19.3R1, the XML output format has changed.