on 01-14-2014 05:36 AM
This document provides an overview for dual stack sessions for ASR9000 BNG, running ipv4 and ipv6 address stacks next to each other for subscriber sessions.
Dual stack refers to the concept of running a subsciber session with an IPv4 address as well as an IPv6 address.
To unravle the complex terminology associated with address assignment in particular to IPv6 this picture below shows the various address assignment options available.
You can also use the framed-ipv6-address radius attribute to provide an address to the subscriber from radius which then will be advertised
via SLAAC (NA/ND) for both PPPoE and IPoE sessions.
The additional attribute ipv6:ipv6-default-gateway VSA can be used to provide the default router in case no dhcpv6 is used for IPoE sessions.
When it comes to "prefix delegation" that is having a large IPv6 like subnet that is shared between subscribers who get a subnet from that subnet sort of speak the following addressing example hopefully visualizes how it all ties together
The following 2 secions provide the configuration for the client side and the WAN side of the CPE
interface GigabitEthernet0/2
description to switch fa0/15
ip address 192.168.1.1 255.255.255.0
no ip unreachables
ip nat inside
ip virtual-reassembly
duplex full
speed 100
media-type rj45
negotiation auto
ipv6 address prefix-from-provider ::1:0:0:0:1/64
interface FastEthernet2/0.50
encapsulation dot1Q 50
ipv6 address autoconfig default
ipv6 enable
ipv6 dhcp client pd prefix-from-provider
In these examples we are expanding the delegated prefix with a :1/64 and we perceive ourselves to be the ".1" and default gateway.
ipv6 unicast-routing
ipv6 dhcp pool dhcpv6
prefix-delegation pool dhcpv6-pool1 lifetime 6000 2000
ipv6 route 2001:60:45:28::/64 2005::1
ipv6 route 2001:DB8:1200::/40 2005::1
ipv6 route 200B::/64 2005::1
ipv6 route 2600:80A::9/128 4000::1
ipv6 local pool dhcpv6-pool1 2001:DB8:1200::/40 48
More info on IOS dhcpv6 server:
http://www.cisco.com/en/US/tech/tk872/technologies_configuration_example09186a0080b8a116.shtml
Because ASR9000 treats the 2 stacks as a single subscriber, and hence ONE access request and a SINGLE accounting record are generated for both stacks, differences of desired operation exist when it comes to when for isntance to generate an accounting request.
There are 2 key things to consider and of importance:
Sample Topology for the configuration example
hostname bng logging console debugging |
Radius server configuration.
Radius server is listening on 5.5.5.2 with auth-port on 1645 and accounting-port on 1646
radius-server host 5.5.5.2 auth-port 1645 acct-port 1646 key 7 010107000A5955 ! |
COA server or policy-server with ip-address 5.5.5.2 is running
aaa server radius dynamic-author client 5.5.5.2 vrf default server-key 7 03165A0F575D72 ! aaa group server radius RADIUS server 5.5.5.2 auth-port 1645 acct-port 1646 ! aaa accounting service default group radius aaa accounting subscriber default group radius aaa authorization subscriber default group radius aaa authentication subscriber default group radius line console stopbits 1 ! |
DHCPv6 address pool is defined locally within BNG box and local pool is used for ipv6 address assignment to IPv6 BNG clients
pool vrf default ipv6 ipv6_address_pool address-range 2001::2 2001::7dff ! |
DHCPv4 server with ip address 20.20.20.2 is deployed externally and this ipv4 address should be reachable from BNG device. Routing protocols should take care of reachability of 20.20.20.2 from BNG device. DHCPv4 proxy is configured as follows.
dhcp ipv4 profile IPoEv4 proxy helper-address vrf default 20.20.20.2 giaddr 10.10.10.1 ! |
DHCPv4 proxy is enabled on bundle sub-interface
interface Bundle-Ether1.10 proxy profile IPoEv4 ! |
DHCPv6 server is configured and already configured DHCPv6 address pool is referred within DHCPv6 server configuration. DHCPv6 profile is configured as follows with address pool.
dhcp ipv6 profile IPoEv6 server address-pool ipv6_address_pool ! |
DHCPv6 address pool is referred on bundle sub-interface.
interface Bundle-Ether1.10 server profile IPoEv6 ! interface Bundle-Ether1 bundle maximum-active links 1 ! |
Bundle sub-interface with dot1q encapsulation configured with single tag. Subscriber traffic from
CPE should come with single dot1q tag and this vlan tag should match with vlan id 10 configured under bundle sub-interface. In dual-stack IPoE configuration, “initiator dhcp” is configured ipv4/ipv6 l2 connect mode.
Policy-map type control’s name is referred with service-policy
interface Bundle-Ether1.10 ipv4 point-to-point ipv4 unnumbered Loopback1 ipv6 enable service-policy type control subscriber pm-src-mac encapsulation dot1q 10 ipsubscriber ipv4 l2-connected initiator dhcp ! ipsubscriber ipv6 l2-connected initiator dhcp ! ! |
Ipv4 address 10.10.10.1 is default-gateway ip address for pool of ipv4 address allocated to dual-stack BNG clients
interface Loopback1 ipv4 address 10.10.10.1 255.255.255.0 ipv6 enable ! interface MgmtEth0/RSP0/CPU0/0 ipv4 address 9.22.11.3 255.255.0.0 ! interface MgmtEth0/RSP0/CPU0/1 shutdown ! |
Physical interface gigabit0/0/0/0 is configured as bundle interface.
interface GigabitEthernet0/0/0/0 bundle id 1 mode on negotiation auto transceiver permit pid all ! interface GigabitEthernet0/0/0/1 ipv4 address 20.20.20.1 255.255.255.0 transceiver permit pid all ! interface GigabitEthernet0/0/0/5 ipv4 address 5.5.5.1 255.255.255.0 ! |
Dual-stack dynamic-template is configured for dual-stack initiation. “ipv6 enabled” under dual-stack template and ipv4 unnumbered
address, ipv4 urpf configured.
dynamic-template type ipsubscriber Dual_stack_IPoE accounting aaa list default type session periodic-interval 5 ipv4 verify unicast source reachable-via rx ipv4 unnumbered Loopback1 ipv6 enable ! ! |
Class-map configured for dual-stack scenario to match DHCPv6 – SOLICIT and DHCPv4 DISCOVER as sign of life packet
class-map type control subscriber match-any dual_stack_class_map match protocol dhcpv4 dhcpv6 end-class-map |
Class-map “Dual_stack_class_map “ is referred within policy-map. Even session-start is hit based on DHCPv4/DHCPv6 FSOL, template “Dual_stack_IPoE” is activated. Subscriber mac-address is used as subscriber identification and it is authorized with AAA server
policy-map type control subscriber pm-src-mac event session-start match-all class type control subscriber dual_stack_class_map do-all 1 activate dynamic-template Dual_stack_IPoE 2 authorize aaa list default identifier source-address-mac password cisco ! ! end-policy-map ! end |
”show subscriber session all” command shows ipv4/ipv6 clients session active
RP/0/RSP0/CPU0:bng#show subscriber session all Tue Jan 29 12:49:25.237 UTC Codes: IN - Initialize, CN - Connecting, CD - Connected, AC - Activated, ID - Idle, DN - Disconnecting, ED - End Type Interface State Subscriber IP Addr / Prefix LNS Address (Vrf) -------------------------------------------------------------------------------- IP:DHCP BE1.10.ip22 AC 10.10.10.10 (default) 2001::2 (default)
|
Command “show subscriber session all detail” should show ipv4/ipv6 clients details detailly.
RP/0/RSP0/CPU0:bng#show subscriber session all deta Tue Jan 29 12:49:27.752 UTC Interface: Bundle-Ether1.10.ip22 Circuit ID: Unknown Remote ID: Unknown Type: IP: DHCP-trigger IPv4 State: Up, Tue Jan 29 12:46:32 2013 IPv4 Address: 10.10.10.10, VRF: default IPv6 State: Up, Tue Jan 29 12:46:42 2013 IPv6 Address: 2001::2, VRF: default IPv6 Interface ID: ..d..... (02 00 64 ff fe 01 01 02) Mac Address: 0000.6401.0102 Account-Session Id: 0000001c Nas-Port: Unknown User name: 0000.6401.0102 Outer VLAN ID: 10 Subscriber Label: 0x00000055 Created: Tue Jan 29 12:46:32 2013 State: Activated Authentication: unauthenticated Access-interface: Bundle-Ether1.10 Policy Executed: policy-map type control subscriber pm-src-mac event Session-Start match-all [at Tue Jan 29 12:46:32 2013] class type control subscriber dual_stack_class_map do-all [Succeeded] 1 activate dynamic-template Dual_stack_IPoE [Succeeded] 2 authorize aaa list default [Succeeded] Session Accounting: Acct-Session-Id: 0000001c Method-list: default Accounting started: Tue Jan 29 12:46:32 2013 Interim accounting: On, interval 1 mins Last successful update: Tue Jan 29 12:48:34 2013 Next update in: 00:00:06 (dhms) Last COA request received: unavailable |
”show dhcp ipv4 proxy binding” command is going to show ipoev4 clients created with ip-address and mac-address, interface on which it is created, vrf-name etc
RP/0/RSP0/CPU0:bng#show dhcp ipv4 proxy binding Tue Jan 29 12:49:42.955 UTC
Lease
MAC Address IP Address State Remaining Interface VRF Sublabel -------------- -------------- --------- --------- ------------------- --------- ----------
0000.6401.0102 10.10.10.10 BOUND 3409 BE1.10 default 0x55 |
RP/0/RSP0/CPU0:bng#show dhcp ipv4 proxy binding de Tue Jan 29 12:49:49.498 UTC MAC Address: 0000.6401.0102 VRF: default Server VRF: default IP Address: 10.10.10.10 Giaddr from client: 0.0.0.0 Giaddr to server: 10.10.10.1 Server IP Address: 20.20.20.2 Server IP Address to client: 10.10.10.1 ReceivedCircuit ID: - InsertedCircuit ID: - ReceivedRemote ID: - InsertedRemote ID: - ReceivedVSISO: - InsertedVSISO: - Auth. on received relay info:FALSE Profile: IPoEv4 State: BOUND Proxy lease: 3600 secs (01:00:00) Proxy lease remaining: 3403 secs (00:56:43) Client ID: 0x00-0x00-0x64-0x01-0x01-0x02 Access Interface: Bundle-Ether1.10 Access VRF: default VLAN Id: 10 Subscriber Label: 0x55 Subscriber Interface: Bundle-Ether1.10.ip22 |
“show dhcp ipv6 server binding” is going to show ipv6 address allocated from DHCPv6 local pool
RP/0/RSP0/CPU0:bng#show dhcp ipv6 server binding Tue Jan 29 12:50:04.560 UTC Summary: Total number of clients: 1 DUID : 00030001000064010102 MAC Address: 0000.6401.0102 Client Link Local: fe80::200:64ff:fe01:102 Sublabel: 0x55 IA ID: 0x0 STATE: BOUND IPv6 Address: 2001::2 (Bundle-Ether1.10) lifetime : 600 secs (00:10:00) expiration: 399 secs (00:06:39) RP/0/RSP0/CPU0:bng# |
Configuration example and verification provided by Narendiran Rajaram
Xander Thuijs CCIE #6775
Principal Engineer ASR9000, IOS-XR and NCS6000
Well, the configured link-local address in reachable if I do
But not 2001::1/128 which is also on the same interface. This is just crazy!
On another BNG running 5.3.4 it's ok, why shouldn't it be, right :)
This one is running 6.1.3 32Bit
show route
% Network not in table
sh run inter loopback 10075
interface Loopback10075
description # IPoE GW #
vrf ipoe
ipv4 address 100.75.0.1 255.255.0.0
ipv6 address fe80::cafe link-local
ipv6 address 2001::1/128
!
show route vrf ipoe ipv6 2001::1/128
% Network not in table
sh run
address-family ipv4 unicast
import route-target
65101:3130
!
export route-target
65101:3130
!
!
address-family ipv6 unicast
import route-target
65101:50
!
export route-target
65101:50
!
ping
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001::1, timeout is 2 seconds:
..
Success rate is 0 percent (0/3)
My colleague has filed two TAC SR for two BNG that are running 6.1.3
SR
SR
hmm the fact that the route is not in the vrf show route is worrisome and likely part of the issue there already. this is not a bng issue per-se but merely an ipv6 routing situation.
I dont know why the address is not inserted into the vrf, but have you tried a reconfiguration of the loopback?
I will also take a look at the cases.
cheers!
xander
hi smail, as for 682071148 the issue is related to a bundle vs phy mac. this is caused by an ifmgr restart during normal operation. of course it should not change the mac and use the bundle only. this was first seen in 434 I recall but disappeared in 51x after the increased mac capability for hsrp/vrrp (same issue with vmac and phy mac). the workaround would be to restart the vic on the location where the bundle member(s) is/are. let me see if there is a new ddts for this.
682071387 seems to be the one that we are discusisng here with the missing v6 addr of the loopback in the vrf.
xander
Removing and adding back the Loopback
I will tell my colleague to test IPv6 connectivity this Monday. I remember that it was not possible to ping the IPv6 neighbor (BNG's address) from the CPE.
I see that my colleague has exchanged some e-mails today with the TAC engineer.
They did restart process
Thank you very much for providing useful information here.
I am currently working on another project thus not fully involved in the BNG project. I remember that I had some weird issue before, but hey it's a
ah great to hear smail! yeah this is not bng specific, not sure how that happened, if you have a solid repro for this, would be reasonable to file a tac case/ddts for that.
cheers!
xander
I have asked my colleague to do
Dear Xander
if i want to authenticate with:
* group1_user to "default" method list using radius1,
* group2_user to "specific" method list using radius2,
how should be "aaa authentication", "aaa authorization" and "aaa accounting" configuration then ?
say following radius configuation:
!
aaa group server radius RAD1
vrf admin
server-private 172.20.1.5 auth-port 1645 acct-port 1646
key group1
!
source-interface MgmtEth0/RSP0/CPU0/1
!
aaa group server radius RAD2
vrf admin
server-private 172.20.1.10 auth-port 1645 acct-port 1646
key group2
!
source-interface MgmtEth0/RSP0/CPU0/1
!
Thanks for help
jp
JP,
have you tried something along these lines:
aaa authentication subscriber Specific group RAD2 ! aaa attribute format AAA-AF
format-string length 253 "%s@%s" client-mac-address dhcp-vendor-class ! policy-map type control subscriber IPoE_Auth event session-start match-first class type control subscriber IPoE do-until-failure 10 activate dynamic-template IPoE 20 authorize aaa list Specific format AAA-AF password cisco
/Aleksandar
Hi,
this issue did not appear again on any device.
All good!
Hi all,
Great post and comments on DS BNG. I've been trying to set it up on an ASR9001 with local pool for SLAAC and DHCPv6 for PD assignments but ran into some issues.
The setup is PPPoE sessions in a VRF.
On XR 5.3.4 DHCPv6 PD was working fine and the CPE (Cisco 1800) got a prefix assigned, but did not receive any prefix via SLAAC. Debugging showed that the ASR9K received the RS but didn't respond with a RA msg.
Now I've upgraded to 6.1.4 and SLAAC works fine, but now the CPE doesn't get a PD prefix. From DHCP debugging on both sides I can see that the ASR9K receives the request, allocates and installs a prefix in the routing table, and from the DHCP debug output the ASR9K claims to send the response but the CPE doesn't receive it.
Tried both XR versions with bundle and physical interfaces without any changes to the issues.
Any recommendations on software versions or other valuable input?
-- Config output --
dynamic-template
type ppp PPP_TPL
ppp authentication pap
ppp ipcp dns 8.8.8.8 8.8.4.4
ppp ipcp peer-address pool PPPOEPOOLv4
vrf internet
timeout idle 4200
accounting aaa list BNG_ACCT type session periodic-interval 10
ipv4 verify unicast source reachable-via rx
ipv4 unnumbered Loopback666
ipv6 nd framed-prefix-pool PPPOEPOOLv6
ipv6 enable
dhcpv6 delegated-prefix-pool PD_POOL
!
pool vrf internet ipv4 PPPOEPOOLv4
address-range 100.64.2.0 100.64.3.255
!
pool vrf internet ipv6 PD_POOL
prefix-length 60
network 2001:beef::/48
!
pool vrf internet ipv6 PPPOEPOOLv6
prefix-length 64
network 2001:f00d::/48
!
dhcp ipv6
profile DHCPv6_PD server
lease 8
prefix-pool PD_POOL
rapid-commit
!
interface subscriber-pppoe profile DHCPv6_PD
database
!
Hi Xander,
This is a very basic question. I have spent much time to get a solid conclusion so I hope you can just give a quick answer. I'm not quite understand the "IPv6 client address assignment. models".
As to the first 2 models, they are about DHCPv6 PD for LAN, DHHCPv6 NA or Link Local SLAAC for the WAN. Does the "Link local" here has any special meaning or it's just normal SLAAC?
As to the bottom 2 models, I'm not sure what exactly is supported and not support? I'm not sure about the scope of the "stop" sign. The whole model 4 is not supported or just "SLAAC"? Could you help me with this? Could you also help if there is any enhancement later.
DHCPv6 NA <<< I think this is for both IPoE and PPPoE?
SLAAC + Stateless DHCPv6(PPPoE) <<< Does this only supported for PPPoE?
----
SLAAC <<< Does it mean "SLAAC only" is not supported for either PPPoE or IPoE?
SLAAC + Stateless DHCPv6(IPoE) <<< This is not supported for IPoE?
Thanks, William
Hello
I Would like to share my problem, regarding DS PPPoE and IPoE.
to setup session, everything work well even for PPPoE or IPoE.
First, to explain my architecture, ASR9001 act as DHCP IPv4 and IPV6 server, so I can better manager dhcp-class.
PPPoE : pppoe/dhcpv6 on policy-map
IPoE : dhcpv4/dhcpv6 on policy-map
Topology:
PC<=>CPE<=>OLT<=>BNG (DHCP Server)<=>INTERNET
After session UP
both PPPoE/IPoE work DS:
PPPoE IPv4 authenticated by RADIUS (AAA)
PPPoE IPv6 authorization/accoutning by RADIUS
IPoE IPv4 authorization/accoutning by RADIUS
IPoE IPv6 authorization/accoutning by RADIUS
When come the time for disconnection and reconnection on time out, or console command (clear subs ses id...):
PPPoE:
* it seems work well, ie disconnect and reconnect with new IPv4/IPv6 address
IPOE:
* once connected, I have following IP address state:
IP:DHCP BE10.3613.ip23 AC 172.20.1.12 (default)
2001:db8:600:500::/56 (default) >>> fictive IPv6 address subnet
At this state, I have 3 differents situations:
1) if the CPE dual stack reboot, it take new public IPv4 address, but keep ipv6 subnet provided before reboot.
==> the laptop will take new ipv6 address and it works
2) if there is a release from BNG, the session renew with same ipv4 address but NOT ipv6 address (ie. the session become ipv4 session only, even no protocol change eon CPE dual-stack)
IP:DHCP BE10.3613.ip23 AC 172.20.1.12 (default)
==> as the laptop is behinf the CPE, it keep private ipv4 address (10.10.10.1/24 for ex) and also original public ipv6 address (2001:db8:600:500:x:x:x:x).
At this state, there is a problem because, all OS priorize now ipv6 traffic first, and then ipv4 traffic if no answer. So I can see a delay du to this request v6/v4. the only way is to release laptop dhcp service.
3) if there is a release from BNG, the session renew with same ipv4 address but with NEW ipv6 address
IP:DHCP BE10.3613.ip23 AC 172.20.1.12 (default)
2001:db8:600:300::/56 (default) >>> fictive IPv6 address subnet
==> the CPE net new dual-stack ip addresses side WAN.
==> as the laptop is behinf the CPE, it keep normally private ipv4 address (10.10.10.1/24 for ex) and also previous public ipv6 address (2001:db8:600:500:x:x:x:x), and not the new one received in PD.
==> at this state , there is also a problem because, all OS priorize now ipv6 traffic first, and then ipv4 traffic if no answer.
==> so I can see a delay du to this request v6/v4.
==> the only way is to disconnect laptop interface and reconnect to retreive now ipv6 address
The situations 2 and 3 cause delay for customers, and waste time for customer support.
Is there anyway to properly disconnect the session in timeout, or on BNG console, in order:
* to send correctely release to CPE (over OLT), so the CPE can take note of disconnection, and do necessay to resend new subnet to LAN behind CPE?
Thanks for sharing possible solution.
Noruni
Hi, Xander:
Quick question: how can a BNG handling IPoEv6 sessions detect than, say, an ONT is not there anymore and proactively delete a session to recover those resources?
Does that only happen when the DHCPv6 lease times out and the session has to renew itself? Or is there another way this happens. I'm asking because I have a testbed and the session is still up, while the ONT has been powered off for a day.
I assume that this is one reason for the "timeout idle 60" command, right?
Hope you find the time to answer this question.
Thanks!
c.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: