ANCP Agent and AAA

The ANCP agent reports both unadjusted (net) data rates and adjusted data rates for subscriber traffic to AAA for RADIUS authentication and accounting of subscriber sessions. The adjusted data rate enables RADIUS to allocate the appropriate services (including class of service) to PPPoE sessions during authentication. The rate reports also enable RADIUS accounting to track the class of service actually provided for the PPPoE sessions, which in turn enables accurate billing for subscriber services.

The access nodes send ANCP DSL attributes in ANCP messages to the router, where they are stored in the shared database. AAA maps the ANCP DSL attributes to both the Juniper Networks DSL VSAs (used by RADIUS) and the DSL Forum VSA subattributes (also called the DSL Forum VSAs). RADIUS uses these attributes during authentication and accounting for PPPoE sessions on the subscriber access line. The attributes persist even when the ANCP session to a given node has ended, enabling RADIUS to later apply these attributes to new sessions on that subscriber access line. To remove the attributes, you must delete the interface or interface set for the access line from the ANCP agent configuration.

The RADIUS profile must be configured to include the juniper-access-line-attributes option, or AAA does not report the attributes to RADIUS. If the ANCP DSL attributes are unavailable, AAA maps the session’s advisory upstream and downstream data rates (as configured on the session’s underlying interface) to the Juniper Networks VSAs, Upstream-Calculated-Qos-Rate [26-142] and Downstream-Calculated-Qos-Rate [26-141], respectively. AAA subsequently provides only these VSAs to RADIUS.

For successful authentication and accounting by RADIUS, AAA has to correlate PPPoE and DHCP IP demux sessions with their access lines and their associated DSL attributes. Some access nodes provide the ACI in PADI/PADR packets for the PPPoE sessions or in the DHCP discovery packets for DHCP IP demux sessions.

When the ACI is not provided in a 1:1 VLAN model with interface sets, you must associate the underlying interface for the sessions with the identifier and the interface set. If you do not configure this association, then only the advisory traffic rates are provided to RADIUS. This configuration has no effect when the identifier is provided by the access node.

For the N:1 VLAN model with interface sets, the access node must provide the ACI. If you configure the underlying interface for this model when the access node does not provide the identifier, the subscriber sessions can be incorrectly correlated with access lines.

AAA reports values to RADIUS for the Juniper Networks VSAs 26–141 and 26–142 according to the following scheme:

1. When the PPPoE or DHCP IP demux subscriber session can be correlated with an access line, then the ANCP agent adjusts the downstream and upstream traffic rates reported by the access node according to the ANCP agent CoS configuration. The agent then maps the adjusted rates to Upstream-Calculated-Qos-Rate [26-142] and Downstream-Calculated-Qos-Rate [26-141].

2. If the session cannot be correlated with an access line, but the PPPoE or DHCP discovery packet includes the DSL Forum VSA and the Access-Loop-Encapsulation subattribute includes a value for the AAL5 data link, then the ANCP agent adjusts the Actual-Data-Rate-Downstream and Actual-Data-Rate-Upstream subattributes to account for the ATM 48/53 cell tax. The adjusted rates mapped to Upstream-Calculated-Qos-Rate [26-142] and Downstream-Calculated-Qos-Rate [26-141].

3. If neither of the preceding sets of conditions is satisfied, then the ANCP agent simply maps the recommended downstream and upstream data rates to Upstream-Calculated-Qos-Rate [26-142] and Downstream-Calculated-Qos-Rate [26-141]. The recommended rates are either configured statically for the VLAN or VLAN demux interfaces or are in the dynamic profile that crates the interfaces.

To map an ACI to a static VLAN demux interface, include the access-identifier identifier statement at the [edit protocols ancp interfaces demux0.logical-unit-number] hierarchy level.

To configure advisory upstream and downstream data rates on a static VLAN demux interface, include the upstream-rate rate or downstream-rate rate statements at the [edit interfaces demux0 unit logical-unit-number] hierarchy level.

To configure an underlying interface for the PPPoE sessions in an interface set, include the underlying-interface interface-name statement at the [edit protocols ancp interfaces interface-set interface-set-name] hierarchy level.

When an ACI, and therefore a subscriber access line, has been mapped to an interface or interface set, the ACI can be re-mapped to a different interface or set. When this happens, traffic shaping is adjusted accordingly for the interfaces or interface sets involved. This capability is useful for the Business Services model, where a PPPoE session that is initially classified as a residential household can be reclassified as a business subscriber during RADIUS authentication by using a Junos OS ICE AAA framework Op-Script application.

In the Business Services Model, the PPPoE session initially represents a residential household until RADIUS authentication and authorization takes place. The ANCP agent dynamically maps the household’s access line to the appropriate subscriber interface and applies CoS traffic shaping to the interface. During authentication and authorization, the Op-Script application may classify the PPPoE session as a business subscriber rather than a residential subscriber. If this occurs, the application creates multiple static VLANs and groups them into an interface set. Based on the ANCP agent configuration, the application then statically maps the subscriber’s access line to this static interface set. This interface set can include only static interfaces.

The ANCP agent reverts CoS traffic shaping from the interface previously used by the subscriber and instead applies the shaping to the interface set. This reversion means that the CoS process applies to the interface the next shaping rate in its adjustment control profile.

Some broadband access line information is not supported by standard RADIUS attributes. The DSL Forum defined RADIUS vendor-specific attributes for DSL access lines in RFC 4679, DSL Forum Vendor-Specific RADIUS Attributes. The VSAs include information about the access lines, the subscribers using the lines, and data rates on the lines.

The DSL Forum changed its name to the Broadband Forum and defined new RADIUS VSAs for G.fast (DSL) and PON access technologies. Some of the VSAs previously used only for DSL networks are also used for PON networks. All these VSAs, regardless of access technology, are referred to as DSL Forum VSAs because they are subattributes contained in the DSL Forum VSA.

An ANCP access node can provide this information to the router in the following ways:

• In ANCP messages that carry ANCP access line TLVs (Type-Length-Value attributes)

• In a PPPoE PADI message during PPPoE subscriber discovery

The original ANCP DSL TLVs are defined in RFC 6320, Protocol for Access Node Control Mechanism in Broadband Networks. RFC 6320 Draft Extension, Access Extensions for the Access Node Control Protocol, adds new TLVs for the DSL G.fast and PON VSAs. The ANCP access line TLVs map to both DSL Forum VSAs (IANA vendor ID 3561) and Juniper Networks (IANA vendor ID 4874) access line VSAs.

When the router receives ANCP TLVs from the access node, it does not parse or manipulate the information. Instead it simply passes the access line and traffic information to the RADIUS server in the corresponding RADIUS VSAs mapped from the TLVs. A RADIUS authentication or accounting message can contain any combination of the DSL Forum VSAs and the Juniper Networks VSAs. You can configure the RADIUS access profile to exclude one or more individual attributes, or all DSL Forum VSAs, from being included in RADIUS messages.

The DSL Forum VSAs received by the router during PPPoE and DHCP client discovery are not updated after discovery, whereas the equivalent ANCP attributes are updated whenever there is a change to the access line.

Table 1 shows the relationship between the ANCP TLVs, Juniper Networks VSAs, and DSL Forum VSAs.

Table 2 lists the ANCP TLVs and indicates with a checkmark whether the TLV is used for DSL or PON subscriber access lines.