Understanding ASR9000 BNG Routed Subscriber (DHCPv4 Triggered):
Introduction:
IPoE subscriber sessions can be classified as L2 or L3 (Routed) sessions based on the access network that connects the subscriber to the BNG. If the subscribers are connected via a routed access network (as shown in below figure), the subscriber sessions on BNG are termed as L3 or Routed Subscriber sessions.
Routed Subscriber sessions can be of 2 types IPoE with DHCP as trigger and IPoE with IP-Packet Data traffic as trigger.
With Routed subscriber session support, subscribers anywhere in IP cloud can be provisioned by BNG thus overcoming the restriction of l2-connectivity.
Until 5.1.1 only L2-connected Subscriber sessions were supported. From IOS-XR Release 5.1.1 onwards, ASR9k (BNG) supports DHCPv4 triggered IPoE Routed Subscriber v4 sessions with on-BNG DHCP server.
Pkt triggered routed session support will be from IOS-XR Release 5.2.2 onwards.
Routed Subscriber:
It is evident from the term ‘routed’ that the subscribers can be multiple hops away from BNG (as shown in above figure). As of 5.1.1 only DHCPv4 triggered routed subscribers are supported, so the DSLAM or the previous hop router(s) will relay the DHCP packets (as DHCP relay agents) between subscribers and BNG.
The subscriber initially has no IP address and it starts with DHCP discovery.
The subscriber will be initially identified using client-hw-address field in the DHCP discover which is the first sign of life (FSOL) and session will be created based on this mac address. The subscriber can optionally be authorized based on mac-address and other parameters at this stage. Once this is done subscriber is offered an IP address.
After the DHCP DORA exchange, once the subscriber gets IP address, subscriber will be identified on BNG by its IP address in data-plane and subscriber route is added (This route addition will be based on the summary route to the subscriber network which must be preconfigured).
Other DHCP client packets (release, renew, etc …) will not be considered as FSOLs and forwarded/punted based on the subscriber interface and route.
Later the subscriber can be authorized/authenticated (via HTTPr web authentication) and services can be downloaded and applied to subscriber via Radius / COA.
Restrictions, limitation and other Functional Behavior w.r.t platform and configuration:
- Supported on A9K-MOD80-SE A9K-MOD160-SE and above. Not supported on Trident based LCs ex A9K-8T/4-B, A9K-4T-B etc.
- Supported on only Ether Bundle sub-interfaces as access interface.
- Overlapping IP addresses are not supported on the same access interface, same or different VRFs
- IPv6 DHCP routed sessions are not supported as of 5.1.1 and hence the Dual stack is not supported.
- PPPoE is not supported.
- Supported with DHCP Server on BNG. BNG cannot act as DHCP relay / proxy if the packet trigger is routed/relayed DHCP (As ASR9k BNG cannot act as 2nd or higher order Relay agent in relay chaining).
- DHCP lease query is not supported as FSOL.
- Summary (cover) route pointing to DHCP client subnet must exist.
- HTTP redirect can be applied on Subscribers and access credentials can be authenticated in account-logon event. However we should not attempt changing subscriber ‘s vrf (and few other attributes) in this phase via access-accept / COA. As DHCP pool allocation and subscriber cover route are already allocated in session-start phase and DHCP client would have already received the IP address.
- Cover subscriber subnet summary/route modifications (like next hop ip / vrf) are strictly not allowed. In case if route gets updated due to dynamic routing protocols, the subscriber session will be torn down and freshly created. If summary route gets deleted, subscribers move to DOWN state and subscriber routes will be deleted. Once the summary route recoveres, subscribers move to UP state and routes are re-added.
- Non subscriber traffic will be routed by access-interface as normal router would do. So ACLs can be enabled on access-interface to drop unintended non-dhcp and non-subscriber traffic.
- Initial authorization can happen on mac-address or other DHCP based attributes or BNG access-interface attributes. IP Address cannot be used as we are not aware of ip address allocated by DHCP server to client in advance.
- Before authorization, the subscriber DHCP packets will arrive on access-interface-vrf, after authorization DHCP and other subscriber traffic will arrive on subscriber-interface-vrf.
Feature supported
Feature Support will be same as those supported on L2-connected Bundle RP based subscribers.
Performance and Scale
Scale Numbers
- 64k Single Stack IPv4 subscriber sessions per system
Performance will be same as other L2-connected Bundle RP based subscribers.
Approximate target CPS is listed in the table below, assuming 64K sessions per system.
|
Scale/Call Flow |
IPoE |
|
64k IPv4 |
100 + |
High Availability
|
HA Feature |
Plane |
Bundle subscribers |
|
Process restart |
Control Plane |
Subscriber session state maintained. New subscriber bringup delayed by a small time, depending on the component being restarted. |
|
Data Plane |
No impact to traffic |
|
|
LC OIR |
Control Plane |
With multi-member bundles, no impact is seen. With single member bundles, control plane cannot function since no control packet is received. Session state is not lost since that is stored on the RP. |
|
Data plane |
With multi-member bundles, no impact is seen. With single member bundles, data traffic is lost. No session state is lost. |
|
|
RP FO |
Control Plane |
Significant quiet time (currently more than 10 minutes) before new sessions can be setup. Existing session state is not lost. |
|
Data Plane |
No impact to traffic |
Configuring BNG for DHCPv4 Routed subscribers:
1. Access interface configuration(here Bundle-Ether 1.1 is access-interface):
interface Bundle-Ether1
lacp switchover suppress-flaps 2500
bundle wait-while 1
bundle maximum-active links 2 hot-standby
bundle load-balancing hash dst-ip
dampening 4
!
interface Bundle-Ether1.1
service-policy output vlan_policy_egress subscriber-parent resource-id 0
vrf red
ipv4 address 12.0.0.1 255.255.0.0
service-policy type control subscriber ISN_CNTRL_2
encapsulation dot1q 10
ipsubscriber ipv4 routed
initiator dhcp
!
interface Bundle-Ether2
lacp switchover suppress-flaps 2500
bundle wait-while 1
bundle maximum-active links 1
dampening 4
!
interface Bundle-Ether2.1
service-policy output vlan_policy_egress subscriber-parent resource-id 0
vrf red
ipv4 address 12.2.0.1 255.255.0.0
service-policy type control subscriber ISN_CNTRL_2
encapsulation dot1q 12
ipsubscriber ipv4 routed
initiator dhcp
!
(ipsubscriber ipv4 routed initiator dhcp—is the access interface config for IPoE routed DHCP based subscribers)
2. DHCP profile configuration:
dhcp ipv4
profile DHCP_SERVER1 server
lease 0 3 0
class CLASS_VRF
pool POOL_GREEN
!
class CLASS_VRF_RED
pool pool_bundle1
!
profile DHCP_SERVER2 server
lease 0 3 0
pool pool_bundle2
!
profile DHCP_SERVER3 server
lease 0 3 0
pool pool_bundle3
!
interface Bundle-Ether1.1 server profile DHCP_SERVER1
interface Bundle-Ether2.1 server profile DHCP_SERVER3
!
3. DHCP Pool Configuration:
pool vrf red ipv4 pool_bundle1
address-range 12.8.0.2 12.8.31.65
!
pool vrf green ipv4 POOL_GREEN
address-range 12.100.0.2 12.100.31.65
!
pool vrf red ipv4 pool_bundle3
address-range 12.10.0.2 12.10.31.65
!
4. VRF Configuration:
vrf red
address-family ipv4 unicast
!
vrf green
address-family ipv4 unicast
!
(Note the subscribers on an access-interface can come up in a vrf different from corresponding access-interface vrf. This is called cross-vrf. For this to happen, the subscribers’ subsnet summary route must exist with gateway reachable via access-interface vrf, dhcp pool must be in subscriber vrf. Once the subscriber is created, its vrf cannot be changed - even with coa)
5. Routes configuration:
vrf red
address-family ipv4 unicast
12.8.0.0/16 12.0.0.2
12.10.0.0/16 12.2.0.2
!
vrf green
address-family ipv4 unicast
12.100.0.0/16 vrf red Bundle-Ether1.1 12.0.0.2
!
(Here subscribers in 12.100.0.0 network behind the CPE will come up vrf green using pool POOL-GREEN, while the subscribers in 12.8.0.0 network will come-up in vrf red using pool “pool_bundle1” on same access-interface Bundle-Ether1.1 which is in vrf red)
6. Loopback configuration for usage by IPoE subscriber interfaces.
interface Loopback2
vrf red
ipv4 address 12.21.0.1 255.255.255.255
!
interface Loopback4
vrf green
ipv4 address 12.201.1.1 255.255.0.0
!
7. Control Policy-map and class-map configs
class-map type control subscriber match-any ISN_CM_1
match protocol dhcpv4
!
policy-map type control subscriber ISN_CNTRL_2
event session-start match-all
class type control subscriber ISN_CM_1 do-until-failure
1 activate dynamic-template ISN_TEMPLATE_1
2 authorize aaa list default identifier circuit-id password cisco
3 activate dynamic-template httpr_service_temp_coa
!
event authorization-failure match-all
class type control subscriber ISN_CM_1 do-until-failure
5 activate dynamic-template httpr_service_temp_coa
6 set-timer T1 60
!
event account-logon match-all
class type control subscriber ISN_CM_1 do-until-failure
7 authenticate aaa list default
9 deactivate dynamic-template httpr_service_temp_coa
!
event account-logoff match-all
class type control subscriber ISN_CM_1 do-until-failure
10 disconnect
!
event timer-expiry match-all
class type control subscriber ISN_CM_1 do-until-failure
11 disconnect
!
!
8. Bundle config on physical link
interface GigabitEthernet0/2/0/1
bundle id 2 mode active
!
interface GigabitEthernet0/3/0/1
bundle id 2 mode active
!
9. AAA configs.
radius-server host 8.45.6.173 auth-port 1812 acct-port 1813
key 7 121A0C041104
!
radius-server host 8.45.6.174 auth-port 1712 acct-port 1713
key 7 02050D480809
!
aaa server radius dynamic-author
port 1700
server-key 7 1511040D
client 8.45.6.173 vrf default
server-key 7 070C2E4D
!
!
radius-server source-port extended
aaa accounting network default start-stop group RADIUS1
aaa group server radius RADIUS1
server 8.45.6.173 auth-port 1812 acct-port 1813
server 8.45.6.174 auth-port 1712 acct-port 1713
load-balance method least-outstanding batch-size 30
!
aaa accounting service default group RADIUS1
aaa accounting subscriber default group RADIUS1
aaa accounting subscriber Acctlist1 group RADIUS1
aaa authorization subscriber default group RADIUS1
aaa authentication subscriber default group RADIUS1
!
Show commands and basic troubleshooting commands.
To check subscriber session info
- Show subscriber session all summary
- Show subscriber session all
- Show ipsubscriber access-interface brief
To check DHCP server bindings and statistics . (Helpful in basic debugging)
- Show dhcp ipv4 server binding summary
- Show dhcp vrf <subscriber vrf> ipv4 server statistics
(Note : If the routed sessions are not connecting and if there are any DHCP drops, please check the aaa configs, radius user profiles attributes, dhcp profile and pool configs, UDP stats and NP level drop counters and controller NP counters)
Other debug level information collection for helpful to triage the issue:
- show udp statistics clients location <loc>
- Show subscriber manager disconnect-history unique summary
- Show drops np all location <bundle member location>
- Show tech-support subscriber ipoe
Glossary:
- COA : Change of Authorization
- DHCP : Dynamic Host Configuration Protocol
- FSOL : First Sign Of Life
- HTTPr : HTTP Redirect.
- NP: Network Processor
