Junos OS

Applying Ipv6 Firewall policy via RADIUS Juniper BNG

  • 1.  Applying Ipv6 Firewall policy via RADIUS Juniper BNG

    Posted 10-05-2020 01:09

    Hi

    I am trying to apply QoS firewall policy to PPPoE session in ipv6 mode. I used following configuration on dynamic profile for PPPoE connection:

    Dynamic Profile Configuration
    cluser@vMX1> show configuration dynamic-profiles Virtual-Template1
    interfaces {
    pp0 {
    interface-transmit-statistics;
    unit "$junos-interface-unit" {
    actual-transit-statistics;
    ppp-options {
    pap;
    mru 1430;
    mtu 1430;
    ignore-magic-number-mismatch;
    }
    pppoe-options {
    underlying-interface "$junos-underlying-interface";
    server;
    }
    keepalives interval 120;
    family inet {
    filter {
    input "$junos-input-filter";
    output "$junos-output-filter";
    }
    unnumbered-address lo0.0;
    }
    family inet6 {
    filter {
    input "$junos-input-ipv6-filter";
    output "$junos-output-ipv6-filter";
    }
    address $junos-ipv6-address;
    unnumbered-address lo0.0;
    }
    }
    }
    }

    Also following cell shows the firewall configuration

    Firewall configuration
    jcluser@vMX1> show configuration firewall family inet6
    filter 2Mbps_ipv6 {
    interface-specific;
    term PROCESS {
    then {
    policer Policer_2M_Download;
    forwarding-class best-effort;
    accept;
    }
    }
    }
    filter 1Mbps_ipv6 {
    interface-specific;
    term PROCESS {
    then {
    policer Policer_1M_Upload;
    forwarding-class best-effort;
    accept;
    }
    }
    }

     

    The Policy-names are applied via following AVP:

    217625test2 Cleartext-Password := "123456"
    ERX-IPv6-Ingress-Policy-Name = 1Mbps_ipv6,
    ERX-IPv6-Egress-Policy-Name = 2Mbps_ipv4,

     

    The problem is subscriber is disconnected as soon as it is connected. The Policy itself has no issue. If I configure it directly in dynamic profile and do not pass the names in the AVP, It is connected and works fine..

    What is the issue here?

    Thank you

    Alireza