Junos OS

Expand all | Collapse all

LNS MX480 Subscriber Managmnet (( Commit Problem )

Jump to Best Answer
  • 1.  LNS MX480 Subscriber Managmnet (( Commit Problem )

    Posted 02-05-2018 05:09

    I have MX480 act as LNS with activate Subscriber managment and HCoS

    the problem is that commit can't complete . and the failure is


    error: ffp_intf_ifd_hier_tagging_config_verify: Modified IFD "si-0/0/0" flags 0x2020 is in use by BBE subscriber, commit denied - hierarchical-scheduler config changed
    error: foreign file propagation (ffp) failed

     

    the version is

     

    Spoiler
    Junos: 16.1R6-S1.1
    JUNOS OS Kernel 64-bit  [20171207.04b87e3_builder_stable_10]
    JUNOS OS libs [20171207.04b87e3_builder_stable_10]
    JUNOS OS runtime [20171207.04b87e3_builder_stable_10]
    JUNOS OS time zone information [20171207.04b87e3_builder_stable_10]
    JUNOS network stack and utilities [20171229.043805_builder_junos_161_r6_s1]
    JUNOS libs [20171229.043805_builder_junos_161_r6_s1]
    JUNOS OS libs compat32 [20171207.04b87e3_builder_stable_10]
    JUNOS OS 32-bit compatibility [20171207.04b87e3_builder_stable_10]
    JUNOS libs compat32 [20171229.043805_builder_junos_161_r6_s1]
    JUNOS runtime [20171229.043805_builder_junos_161_r6_s1]
    Junos vmguest package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS py extensions [20171229.043805_builder_junos_161_r6_s1]
    JUNOS py base [20171229.043805_builder_junos_161_r6_s1]
    JUNOS OS vmguest [20171207.04b87e3_builder_stable_10]
    JUNOS OS crypto [20171207.04b87e3_builder_stable_10]
    JUNOS mx libs compat32 [20171229.043805_builder_junos_161_r6_s1]
    JUNOS mx runtime [20171229.043805_builder_junos_161_r6_s1]
    JUNOS common platform support [20171229.043805_builder_junos_161_r6_s1]
    JUNOS modules [20171229.043805_builder_junos_161_r6_s1]
    JUNOS mx modules [20171229.043805_builder_junos_161_r6_s1]
    JUNOS mx libs [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Data Plane Crypto Support [20171229.043805_builder_junos_161_r6_s1]
    JUNOS mtx Data Plane Crypto Support [20171229.043805_builder_junos_161_r6_s1]
    JUNOS daemons [20171229.043805_builder_junos_161_r6_s1]
    JUNOS mx daemons [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Voice Services Container package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services TLB Service PIC package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services SSL [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services Stateful Firewall [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services RPM [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services PTSP Container package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services PCEF package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services NAT [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services Mobile Subscriber Service Container package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services MobileNext Software package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services Logging Report Framework package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services LL-PDF Container package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services Jflow Container package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services Deep Packet Inspection package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services IPSec [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services IDS [20171229.043805_builder_junos_161_r6_s1]
    JUNOS IDP Services [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services HTTP Content Management package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services Crypto [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services Captive Portal and Content Delivery Container package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services COS [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Border Gateway Function package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS AppId Services [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services Application Level Gateways [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Services AACL Container package [20171229.043805_builder_junos_161_r6_s1]
    JUNOS SDN Software Suite [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Extension Toolkit [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Packet Forwarding Engine Support (wrlinux) [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Packet Forwarding Engine Support (MX/EX92XX Common) [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Packet Forwarding Engine Support (M/T Common) [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Packet Forwarding Engine Support (MX Common) [20171229.043805_builder_junos_161_r6_s1]
    JUNOS Online Documentation [20171229.043805_builder_junos_161_r6_s1]

     

    the chassess is

     

    Spoiler
    Hardware inventory:
    Item             Version  Part number  Serial number     Description
    Chassis                                JN126ADABAFB      MX480
    Midplane         REV 46   750-047862   ACRK4568          Enhanced MX480 Midplane
    FPM Board        REV 04   760-059208   CAJP6899          Front Panel Display
    PEM 0            Rev 01   740-063046   QCS1746U0BK       PS 1.4-2.52kW; 90-264V AC in
    PEM 1            Rev 01   740-063046   QCS1744U1FA       PS 1.4-2.52kW; 90-264V AC in
    PEM 2            Rev 01   740-063046   QCS1746U023       PS 1.4-2.52kW; 90-264V AC in
    PEM 3            Rev 01   740-063046   QCS1746U0CV       PS 1.4-2.52kW; 90-264V AC in
    Routing Engine 0 REV 16   750-054758   CAJX7941          RE-S-2X00x6
    CB 0             REV 09   750-062572   CAJZ4066          Enhanced MX SCB 2
    FPC 0            REV 11   750-063184   CAJX6658          MPC2E NG PQ & Flex Q
      CPU            REV 13   711-045719   CAJX1272          RMPC PMB
      MIC 0          REV 18   750-049846   CAJW9955          3D 20x 1GE(LAN)-E,SFP
        PIC 0                 BUILTIN      BUILTIN           10x 1GE(LAN) -E  SFP
          Xcvr 0     REV 01   740-031850   NYF1QKM           SFP-LX10
          Xcvr 2     REV 01   740-031850   NYF0WGJ           SFP-LX10
          Xcvr 4     REV 01   740-031850   NYF0X8L           SFP-LX10
        PIC 1                 BUILTIN      BUILTIN           10x 1GE(LAN) -E  SFP
      MIC 1          REV 33   750-028387   CAHX5975          3D 4x 10GE  XFP
        PIC 2                 BUILTIN      BUILTIN           2x 10GE  XFP
          Xcvr 0     REV 01   740-031833   AYF1BMN           XFP-10G-LR
          Xcvr 1     REV 01   740-031833   AYD1LCM           XFP-10G-LR
        PIC 3                 BUILTIN      BUILTIN           2x 10GE  XFP
          Xcvr 0     REV 01   740-031833   AYF1ND3           XFP-10G-LR
          Xcvr 1     REV 01   740-031833   AYF1BLL           XFP-10G-LR
    Fan Tray                                                 Enhanced Left Fan Tray

     

    the Configuration of chassis and si-0/0/0

     

    Spoiler
    chassis {
        fpc 0 {
            pic 0 {
                tunnel-services {
                    bandwidth 30g;
                }
                inline-services {
                    bandwidth 30g;
                }
                max-queues-per-interface 8;
            }
            flexible-queuing-mode;
        }
        network-services enhanced-ip;
    }


        si-0/0/0 {
            hierarchical-scheduler maximum-hierarchy-levels 2;
            encapsulation generic-services;
            unit 0 {
                family inet;
            }

     

    the only soultion of this problem is to deactive hierarchical-scheduler under si-0/0/0 , but  i see that not affect on online subscriber or there speed ( firewall filter $junos-output-filter" )

     

    trying to solve this problem i update MX480 to recommanded version 16.1R6-S1

    same  problem solved as mention on link below

    https://prsearch.juniper.net/InfoCenter/index?page=prcontent&id=PR1304951

     

    in another thread i see this command

     

    The system is designed to not allow a change to an active profile to be modified as a protection mechanism. There is no way to force the commit to happen.
    The options you have are to:   Disconnect all subscribers currently using the profile and execute the commit. Rollback the configuration changes to undo the change and execute the commit.
    Instead of modifying this dynamic profile to include the new interface ae11, you can create a new dynamic profile with the desired changes, and apply this new profile. This way, all new subscribers will use the new profile and the old profile can be deleted once no subscribers are using it.

     

     



  • 2.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )

     
    Posted 02-05-2018 05:15

    Please read my previous post.



  • 3.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )

    Posted 02-05-2018 05:30

     

    According previous post i activate flexible-queuing-mode on configuration mode , you can check configuration on main topic

    Spoiler

    Hi,

    Please read below document for HCOS

     

    https://www.juniper.net/documentation/en_US/junos/topics/concept/hierarchical-scheduling-mic-mpc-und...

     

    MPC2E NG PQ & Flex Q doesn't support HCOS and it's a non-HCOS card.

     

    To enable queueing on non-HQOS cards, use this command: set chassis fpc <slot#> flexible-queuing-mode.Note that committing "set chassis fpc X flexible-queuing-mode” configuration causes fpc X reboot.

     

    Regards,
    Rahul



  • 4.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )

     
    Posted 02-05-2018 05:35

     

    The error basically pops up when you modify configuration parameter onto the interface were existing subscriber is logged in.

    Logout the subscriber, do the modifyication & commit. Post successful commit, bring the subscriber online.

     

     

     



  • 5.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )

     
    Posted 02-05-2018 05:15

    Are doing any configuration changes post subscriber login?



  • 6.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )

     
    Posted 02-05-2018 05:19

    Hope you're not doing any dynamic-profile releated changes post the subscriber login.. check if versioning is enabled?

     

    show configuration system dynamic-profile-options

     

     

     



  • 7.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )

    Posted 02-05-2018 05:32

    about versioning of dynamic profile is enable .

    Spoiler
    dynamic-profile-options {
        versioning;
    }


    services {
        subscriber-management {
            enable;
        }
    }


  • 8.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )

     
    Posted 02-05-2018 05:34

    Can you share dynamic-profile configuration?

     

    Regards,
    Rahul N



  • 9.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )

    Posted 02-05-2018 06:13

    dynamic profile

    Spoiler

    ADSL-profile {
        routing-instances {
            "$junos-routing-instance" {
                interface "$junos-interface-name";
                routing-options {
                    access {
                        route $junos-framed-route-ip-address-prefix {
                            next-hop "$junos-framed-route-nexthop";
                            metric "$junos-framed-route-cost";
                            preference "$junos-framed-route-distance";
                        }
                    }
                    access-internal {
                        route $junos-subscriber-ip-address {
                            qualified-next-hop "$junos-interface-name";
                        }
                    }
                }
            }
        }
        interfaces {
            "$junos-interface-ifd-name" {
                unit "$junos-interface-unit" {
                    dial-options {
                        l2tp-interface-id l2tp-encapsulation;
                        dedicated;
                    }
                    family inet {
                        filter {
                            output "$junos-output-filter";
                        }
                        unnumbered-address "$junos-loopback-interface";
                    }
                }
            }
        }
    }

    any change of configuration will not commit , for example if you want to change timezone or add login user the commit will not done . just when deactivate hierarchical-scheduler under si-0/0/0 .

    BTW , i deactivate it now . my goal is to limit speed to ADSL user using policier and filter , no need more feature and the limitaion work with deactivation  hierarchical-scheduler



  • 10.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )

     
    Posted 02-05-2018 06:43

    If you modify any other configuration which is not related to subscribers, the system will allow to commit.

    But you modify subscriber related configuration which is in use with existing subscriber and along that you add/delete any other configuration(non-subscriber related), the system will not allow you to commit becuase you modifiying a parameter is in use with existing subscribers.

     

    As you mentioned you want limit subscriber speed and i assume while they are connected, usually this done by creation service dynamic-profile that includes variables for policer/filter for subscriber. This gets attached to subscriber either returning service activation VSA from radius or can changed on fly using CoA without diconnecting subscriber or without doing any configuration changes on node.

     

     

     



  • 11.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )

     
    Posted 02-06-2018 02:12

    Hi,

     

    Please find my lab testing.

     

    As i mentioned eaarlier, MPC2E NG PQ & Flex Q doesn't support HCOS. To resolve commit issue, we need to enable flexible-queuing-mode.

     

    labroot@ERX-MX960-NS-1# show chassis
    fpc 7 {
        pic 0 {
            tunnel-services {
                bandwidth 10g;
            }
            inline-services {
                bandwidth 10g;
            }
        }
    }
    network-services enhanced-ip;


    FPC 7            REV 11   750-054904   CAEV1347          MPC2E NG PQ & Flex Q
      CPU            REV 12   711-045719   CAEV1898          RMPC PMB
      MIC 0          REV 31   750-028387   CAFE7364          3D 4x 10GE  XFP
        PIC 0                 BUILTIN      BUILTIN           2x 10GE  XFP
        PIC 1                 BUILTIN      BUILTIN           2x 10GE  XFP
     
    test# set system login user test class super-user authentication plain-text-password
    New password:
    Retype new password:

    {master}[edit]
    test# commit
    re0:
    error: ffp_intf_ifd_hier_tagging_config_verify: Modified IFD "si-7/0/0" flags 0x20 is in use by BBE subscriber, commit denied - hierarchical-scheduler config changed
    error: foreign file propagation (ffp) failed

    {master}[edit]
    test# run show subscribers
    Interface           IP Address/VLAN ID                      User Name                      LS:RI
    si-7/0/0.3221225477 X.X.X.X                             test@test.com             default:default     

    {master}[edit]
    test# run show interfaces terse | grep si-
    si-7/0/0                up    up
    si-7/0/0.0              up    up   inet   

     

    Logout the subscriber

     

    TEST# run show subscribers   
    Total subscribers: 0, Active Subscribers: 0

     

    Enable the flexiable-queuing-mode


    TEST# set chassis fpc 7 flexible-queuing-mode

     
    TEST# commit
    re0:
    [edit chassis fpc 7]
      'flexible-queuing-mode'
        warning: FPC configuration for flexible-queuing is changed. FPC would undergo reboot to enable flexible-queuing. FPC would come online only if power available is sufficient to enable queuing components.
    configuration check succeeds
    re1:
    [edit chassis fpc 7]
      'flexible-queuing-mode'
        warning: FPC configuration for flexible-queuing is changed. FPC would undergo reboot to enable flexible-queuing. FPC would come online only if power available is sufficient to enable queuing components.
    commit complete
    re0:

     

    Once the FPC is online. Bring up the subscribers.

     

      7  Online            37      8          0       11     10      9    3584        6         25

     

    TEST> show subscribers   
    Interface           IP Address/VLAN ID                      User Name                      LS:RI
    si-7/0/0.3221225478 X.X.X.X                             test@test.com             default:default   

     

    Do the changes and commit. No issues seen this time.

     

    TEST# set system login user test class super-user authentication plain-text-password
    New password:
    Retype new password:

    {master}[edit]
    TEST# commit
    re0:
    configuration check succeeds
    re1:
    commit complete
    re0:
    commit complete

     

    Regards,

    Rahul N



  • 12.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )
    Best Answer

    Posted 02-06-2018 23:27

    Thanks  for your clarify the lab test ..

    actually i do all things that you mention on your post but not work . add flexible-queuing-mode on fpc 0 that i used and the module reboot but still show the error when i commit any change like you do . I have one RE installed  not like your router.

     

    By the way , when i deactivate  hierarchical-scheduler , I can modify any things on configuration

    i test 2 changes one on address-assignment and other on policer .

    the first one i give pool with prefix /24 start from 0 to 255 , when i change range from 30 to 255 all user under 30 disconnect and reconnect taking new IP but when i expand range the users not disconnect . this is great feature not like cisco that want to disconnect user manual when i want to remove one of DHCP range .

     

    the second one is also great feature the when i change the policier bandwith limit from 16m to 24m the user affect directly without diconnect .

     

    until now , i still deactivate hierarchical-scheduler under si-0/0/0 and activated flexible-queuing-mode on fpc 0 . this is the optimal solution that I found . So many thanks for you Rahul and Karan



  • 13.  RE: LNS MX480 Subscriber Managmnet (( Commit Problem )

     
    Posted 02-06-2018 23:38
    Thanks for the post amousa!
    Regarding commit error seen while hierarchical-scheduler is present, we would suggest that you please log a case with us(JTAC), we’ll get that solved as well.