A dynamic interface is created automatically and transparently through some external event, typically through the receipt of data over a lower-layer link, such as an ATM virtual circuit (VC) or a virtual LAN (VLAN) through a process known as autodetection.

The layers of a dynamic interface are created based on the packets received on the link and can be configured through any one of the following:

• RADIUS authentication

•

Profiles

511

JunosE 11.3.x Link Layer Configuration Guide

•

A combination of RADIUS authentication and profiles

You create and configure each layer of a static interface manually through an existing configuration mechanism such as the command-line interface (CLI) or Simple Network

Management Protocol (SNMP).

Unlike static interfaces, dynamic interfaces are not restored through nonvolatile storage

(NVS) after a reboot.

Autodetection

The router performs autodetection, also referred to as autosensing, to determine the layers of each dynamic interface. The autodetection process occurs when the router conditionally constructs interface layers based on the encapsulation type of the incoming packet.

Autodetection only uses system resources on demand based on what is detected in the incoming packet. Dynamic interfaces are created as a result of traffic on the interface.

Dynamic interfaces can also be dynamically deleted without your intervention, thereby enabling any consumed system resources to be returned.

Unlike dynamic interfaces, static interfaces always allocate system resources upon creation, and always consume system resources, even when the interface is quiescent.

Types of Dynamic Interfaces

There are two types of dynamic interfaces: upper-layer and bulk-configured.

Bulk-configured dynamic interfaces enable you to dynamically create ATM 1483 subinterfaces and VLAN subinterfaces by bulk-configuring a range of identifiers. There are two types of bulk-configured dynamic interfaces:

•

ATM 1483 interfaces over static ATM AAL5 interface

• VLAN subinterface over static VLAN major interface

For more information, see “Configuring Dynamic Interfaces Using Bulk Configuration” on page 619.

Upper-layer dynamic interfaces enable you to dynamically create the following configurations:

• Dynamic IP, PPPoE, PPP, MLPPP, and bridged Ethernet interfaces over a static ATM 1483 interface

•

IP or PPPoE interfaces over VLAN interfaces and Ethernet, Gigabit Ethernet, and

10-Gigabit-Ethernet interfaces.

NOTE: Ethernet interfaces in this chapter refer to any of these interfaces Fast

Ethernet, Gigabit Ethernet, or 10–Gigabit-Ethernet.

Chapter 17: Configuring Dynamic Interfaces

Upper-Layer Dynamic Interface Configurations

E Series routers support the following types of upper-layer dynamic interface configurations:

•

Dynamic IP over static ATM 1483 (IPoA)

• Dynamic IP over dynamic PPP over static ATM 1483

• Dynamic IP over dynamic PPP over dynamic PPPoE over static ATM 1483

•

Dynamic IP over dynamic bridged Ethernet over static ATM 1483

•

Dynamic IP over dynamic MLPPP over static ATM 1483

• Dynamic IP over dynamic MLPPP over dynamic PPPoE over static ATM 1483

• Dynamic IP over dynamic PPP over dynamic PPPoE subinterface over static PPPoE major interface (with or without VLANs)

•

Dynamic IP over dynamic MLPPP over dynamic PPPoE subinterface over static PPPoE major interface (with or without VLANs)

• Dynamic IP over dynamic MLPPP over dynamic PPPoE (with or without VLANs)

E Series routers also support the following types of upper-layer dynamic interfaces over static VLAN interfaces:

•

Dynamic Subscriber Interfaces

•

IP over Ethernet

• IP over PPP over Ethernet

Internet Protocol version 4 (IPv4) is supported for all of these upper-layer dynamic interface configurations.

Currently, Internet Protocol version 6 (IPv6) is supported only when PPP or MLPPP is the layer immediately below the IPv6 layer in the interface column. Dynamic IPv6 is not supported directly over static ATM 1483, dynamic bridged Ethernet, or dynamic VLANs.

Upper-layer dynamic interface columns that support IPv6 include the following:

•

Dynamic IPv6 over dynamic PPP over static ATM 1483

• Dynamic IPv6 over dynamic MLPPP over static ATM 1483

• Dynamic IPv6 over dynamic PPP over dynamic PPPoE over static ATM 1483

•

Dynamic IPv6 over dynamic MLPPP over dynamic PPPoE over static ATM 1483

•

Dynamic IPv6 over dynamic PPP over dynamic PPPoE subinterface over static PPPoE major interface (with or without VLANs)

• Dynamic IPv6 over dynamic MLPPP over dynamic PPPoE subinterface over static

PPPoE major interface (with or without VLANs)

513

JunosE 11.3.x Link Layer Configuration Guide

For more information about IPv4, see chapter Configuring IP in JunosE IP, IPv6, and IGP

Configuration Guide. For more information about IPv6, see chapter Configuring IPv6 in

JunosE IP, IPv6, and IGP Configuration Guide.

Profiles

You can use profiles to configure dynamic interfaces over ATM, VLAN, or Ethernet

Interfaces. A profile is a set of characteristics that can be dynamically assigned to interfaces. By using a profile, you reduce the management of a large number of interfaces by applying a set of characteristics to multiple interfaces.

When you are configuring a large number of interfaces with the same attributes at the higher layers, you can use a profile to factor out all the common attributes of each layer into one place. This action affects one or more dynamic layers of the interface column.

After you define the static lower layers, you assign a profile to the highest static layer of the interface column.

When a dynamic interface is configured, the configuration data received from the RADIUS authentication server typically overrides configuration data obtained from a profile.

In contrast to static PPP interfaces (above which only dynamic IP interfaces can be created), static ATM 1483 subinterfaces support recognition and creation of the following upper dynamic interface types or encapsulations:

•

Bridged Ethernet

•

• IPv6

• Multilink PPP

•

PPP

•

PPPoE

The auto-configure command identifies the encapsulation type. For flexibility, the router provides the ability to configure an ATM 1483 subinterface with distinct profile assignments for each encapsulation type supported by the auto-configure command.

For more information about using this command, see “auto-configure Command” on page 521.

RADIUS Authentication

RADIUS helps protect your network against unauthorized access. To accomplish this,

RADIUS clients running on your router send authentication requests to a central RADIUS server. You can configure dynamic interfaces over interfaces through RADIUS authentication.

When a packet is received, the authenticating interface, either PPP or ATM 1483, establishes a session with RADIUS and passes the username and password to the RADIUS server. For dynamic IPoA or dynamic bridged Ethernet, the RADIUS username and password are obtained from the information specified by the subscriber command. The

RADIUS server returns a grant or deny indication. If authentication is granted, the RADIUS

Chapter 17: Configuring Dynamic Interfaces attributes are returned, a user login is created, and the dynamic interfaces are configured from the RADIUS attributes.

ATM 1483 interfaces may receive configuration data from the RADIUS server in the form of traffic-shaping parameters.

Any changes made to a RADIUS configuration for a given dynamic interface do not take effect until an existing dynamic interface configured from this RADIUS entry is re-created, that is, deleted and then dynamically created.

ATM Oversubscription for Dynamic Interfaces

You can take advantage of oversubscription of static ATM 1483 subinterfaces and bulk-configured ATM VCs with the following dynamic interface configurations:

• The router supports oversubscription of static ATM 1483 subinterfaces when you configure the static ATM 1483 subinterface to support one of the following dynamic upper-layer encapsulation types: bridged Ethernet, IP, Multilink PPP, PPP, and PPPoE interfaces. For information about configuring dynamic upper-layer encapsulation types

over a static ATM 1483 subinterface, see “About Configuring Dynamic Interfaces over

Static ATM” on page 518.

•

The router supports oversubscription of bulk-configured VC ranges when you create a bulk-configured VC range on a static ATM AAL5 interface for use by a dynamic

ATM 1483 subinterface. For information about configuring dynamic ATM 1483

subinterfaces with bulk-configured VC ranges, see “Configuring ATM 1483 Dynamic

Subinterfaces” on page 624 in “Configuring Dynamic Interfaces Using Bulk Configuration” on page 619.

How Oversubscription Works

Oversubscription is based on the capabilities of the ATM line module on which the dynamic interface is configured. For details about the capabilities of specific ATM line modules,

see either “Module Capabilities” on page 11 in “Configuring ATM” on page 3, or the Link

Layer Maximums tables in JunosE Release Notes, Appendix A, System Maximums.

Each ATM line module supports a maximum number of configured subinterfaces or VCs, and a smaller maximum number of subinterfaces or VCs that can be active at any one time. The maximum number of active subinterfaces or VCs determines the number of subscribers that can connect to the router through this line module at any one time.

As a result, you can oversubscribe static ATM 1483 subinterfaces or bulk-configured VC ranges by creating up to the maximum number of configured subinterfaces or VCs supported on the module, knowing that no more than the maximum number of active subinterfaces or VCs can be connected to the router at any one time.

Static ATM 1483 Subinterfaces

An active static ATM 1483 subinterface currently supports a dynamic upper-layer encapsulation type such as PPP or PPPoE. For ATM line modules that support ATM subinterface oversubscription, the maximum number of active subinterfaces supported per module is less than the maximum number of configured subinterfaces supported per module.

515

JunosE 11.3.x Link Layer Configuration Guide

When the maximum number of active ATM 1483 subinterfaces has been reached, the router prevents all additional subscribers from connecting to the line module until at least one currently active subscriber logs out, which causes the router to tear down the dynamic interface column for that subscriber. When a dynamic interface column is torn down, the router enables the first currently inactive subscriber that receives traffic to connect to the router and become active as a replacement for the subscriber that logged out.

Example

Consider an ATM line module that supports a maximum of 16,000 configured subinterfaces and a maximum of 8000 active subinterfaces. If all 16,000 static ATM 1483 subinterfaces attempt to connect to the router, only the first 8000 subinterfaces to receive traffic are able to log in, generate dynamic interface columns, and become active.

When a subscriber connected through one of these active subinterfaces logs out, the router enables the first of the remaining 8000 inactive subinterfaces that receives traffic to connect as a replacement for the subscriber that logged out.

Bulk-Configured VC Ranges

An active bulk-configured VC range is associated with a dynamic ATM 1483 subinterface that supports a dynamic upper-layer encapsulation type. For ATM line modules that support VC oversubscription, the maximum number of active bulk-configured VCs per line module is less than the maximum number of individual VCs created from the total number of bulk-configured VC ranges that the line module supports.

For details about how oversubscription works for bulk-configured VC ranges, see “ATM

Oversubscription for Bulk-Configured VC Ranges” on page 621 in “Configuring Dynamic

Interfaces Using Bulk Configuration” on page 619.

Combination of Static ATM 1483 Subinterfaces and Bulk-Configured VC Ranges

ATM line modules are sometimes configured with a combination of static ATM 1483 subinterfaces and bulk-configured VC ranges. In these configurations, both the static

ATM 1483 subinterfaces and bulk-configured VC ranges can support active subinterfaces.

The combined total of active static ATM 1483 subinterfaces, and active dynamic ATM 1483 subinterfaces created from bulk-configured VC ranges, cannot exceed the maximum number of active subinterfaces supported by the line module.

For details about how oversubscription works for ATM modules configured with both

static ATM 1483 subinterfaces and bulk-configured VC ranges, see “ATM Oversubscription

for Bulk-Configured VC Ranges” on page 621 in “Configuring Dynamic Interfaces Using

Bulk Configuration” on page 619.

Ethernet Oversubscription for Dynamic Interfaces

When you configure S-VLAN subinterfaces over Ethernet interfaces to support dynamic

PPPoE subinterfaces, you can take advantage of VLAN and S-VLAN oversubscription.

For more information on S-VLAN oversubscription, see “S-VLAN Oversubscription” on page 185 .

Chapter 17: Configuring Dynamic Interfaces

Platform Considerations

Module Requirements

For information about the modules that support dynamic interfaces on ERX14xx models,

ERX7xx models, and the ERX310 router:

• See ERX Module Guide, Table 1, Module Combinations for detailed module specifications.

•

See ERX Module Guide, Appendix A, Module Protocol Support for information about the modules that support dynamic interfaces.

For information about the modules that support dynamic interfaces on the E120 and

E320 routers:

• See E120 and E320 Module Guide, Table 1, Modules and IOAs for detailed module specifications.

•

See E120 and E320 Module Guide, Appendix A, IOA Protocol Support for information about the modules that support dynamic interfaces.

Interface Specifiers

You can configure dynamic interfaces on the following E Series Broadband Services

Routers:

•

E120 router

•

E320 router

• ERX1440 router

• ERX1410 router

•

ERX710 router

•

ERX705 router

• ERX310 router

The configuration task examples in this chapter use the slot/port[.subinterface ] format to specify the physical interface that you want to configure to support dynamic interfaces.

However, the interface specifier format that you use depends on the router that you are using.

For ERX7xx models, ERX14xx models, and ERX310 router, use the slot/port[.subinterface

] format. For example, the following command specifies ATM 1483 subinterface 10 on slot 0, port 1 of an ERX7xx model, ERX14xx model, or ERX310 router.

host1(config)#interface atm 0/1.10

For E120 and E320 routers, use the slot/adapter/port[.subinterface ] format, which includes an identifier for the bay in which the I/O adapter (IOA) resides. In the software, adapter

0 identifies the right IOA bay (E120 router) and the upper IOA bay (E320 router); adapter

1 identifies the left IOA bay (E120 router) and the lower IOA bay (E320 router). For

517

JunosE 11.3.x Link Layer Configuration Guide example, the following command specifies ATM 1483 subinterface 20 on slot 5, adapter

0, port 0 of an E320 router.

host1(config)#interface atm 5/0/0.20

For more information about supported interface types and specifiers on E Series routers, see Interface Types and Specifiers in JunosE Command Reference Guide.

References

For more information about RADIUS, consult the following resources:

• RFC 2865—Remote Authentication Dial In User Service (RADIUS) (June 2000)

•

RFC 2866—RADIUS Accounting (June 2000)

About Configuring Dynamic Interfaces over Static ATM

To create dynamic interfaces over ATM, you create the static layers of the interface first, and then configure them to support a dynamic interface by means of autodetection.

Figure 46 on page 518 shows an example of the interface stack for a dynamic IP over

ATM 1483 interface.

Figure 46: Configuring an ATM 1483 Interface to Support Dynamic

Interfaces

518

On receipt of a packet, the router creates all dynamic layers above the ATM 1483 layer, starting with the lowest dynamic layer. For example, in the case of a dynamic PPPoE interface, the router creates the PPPoE interface first, then the PPP interface, and then the IP interface.

If any layer of the dynamic portion of the interface column fails to be created, then the interface creation fails and the connection is denied. All dynamic layers above the ATM

1483 subinterface are destroyed, starting with the highest dynamic layer.

When you configure a dynamic interface, you must assign (or create and assign) a profile to the interface. Profile creation and assignment topics are discussed in depth in

“Configuring a Dynamic Interface from a Profile” on page 559.

Chapter 17: Configuring Dynamic Interfaces

About Configuring RADIUS for Dynamic Interfaces

Dynamic interfaces can be configured automatically through authentication and authorization by the RADIUS server.

On ATM interfaces, you initially create the static portion of the interface column by creating an ATM interface, ATM 1483 subinterface, and underlying ATM permanent virtual circuit (PVC).

subscriber Command

For dynamic interfaces that do not have a PPP layer, such as IPoA, you can use the subscriber command to configure an ATM 1483 subinterface to be authenticated automatically by the RADIUS server. The subscriber command uses a RADIUS username and optional password for identification and is available only for bridged Ethernet and

IPoA configurations. This command is used for dynamic encapsulations that do not provide the authentication information remotely, as PPP does.

For dynamic interfaces with a PPP layer, the RADIUS username and password are obtained from the remote client, and authentication is performed with the RADIUS server. The attributes obtained from RADIUS can then be used to configure any higher-layer dynamic interfaces, such as IP, that are built over PPP.

For more information about using the subscriber command, see “subscriber” on page 553.

Authenticating Subscribers on Dynamic Bridged Ethernet over Static ATM

Interfaces

You can use either of the following methods to configure and manage RADIUS authentication for IP subscribers on dynamic bridged Ethernet over static ATM interfaces:

• The subscriber command

•

The subscriber management application

The subscriber command does not support running stateful SRP switchover (high availability) on the router. Therefore, the configuration method you choose depends on whether stateful SRP switchover is or is not running on your router.

Configuration Method Using subscriber Command

When you use the subscriber command to configure IP subscribers on dynamic bridged

Ethernet over static ATM 1483 interface columns to support RADIUS authentication, the subscriber command provides the subscriber’s authentication parameters. The static

ATM 1483 subinterface acts as the authenticating layer that establishes a session with

RADIUS and passes the subscriber’s locally configured username and password information to the RADIUS server.

However, if your router is running stateful SRP switchover (high availability), the use of the subscriber command in this configuration might suspend stateful SRP switchover on the router or prevent stateful SRP switchover from becoming active. To bypass this limitation, you can use the subscriber management application to configure IP subscribers on dynamic bridged Ethernet interfaces.

519

JunosE 11.3.x Link Layer Configuration Guide

520

Configuration Method Using Subscriber Management Application

You can use the JunosE subscriber management application to configure and manage

IP subscribers associated with a dynamic bridged Ethernet interface column. The subscriber management application uses an IP service profile to manage and authenticate

IP subscribers with RADIUS. An IP service profile contains user and password information, and is used in a route map for subscriber management and to authenticate subscribers with RADIUS.

In this configuration, the IP service profile provides the subscriber’s authentication parameters, and the subscriber management application acts as the authenticating layer to obtain information from RADIUS for configuration of dynamic IP subscribers. To assign the IP service profile to the interface profile from which the dynamic bridged Ethernet interface is created, you use the bridge1483 service-profile command in Profile

Configuration mode.

If stateful SRP switchover is disabled or not running on your router, you can continue to use the subscriber command to configure IP subscribers on dynamic bridged Ethernet interfaces to support RADIUS authentication.

Alternatively, you can use the subscriber management application to create and configure dynamic IP interfaces regardless of whether stateful SRP switchover is running on the router. In addition, using subscriber management enables you to take advantage of several useful features such as the IP inactivity timer.

In the event that an interface profile for a dynamic bridged Ethernet interface includes the subscriber command to configure a local subscriber as well as the bridge1483 service-profile command to reference an IP service profile, the values specified with the subscriber command take precedence. The router ignores the values in the IP service profile in this case.

For details about using the subscriber management application to configure RADIUS

authentication for IP subscribers on dynamic bridged Ethernet interfaces, see “Configuring

Subscriber Management for IP Subscribers on Dynamic Bridged Ethernet Interfaces” on page 557.

For more information about using the subscriber management application, see JunosE

Broadband Access Configuration Guide.

Placing Dynamic IP Routes in the Routing Table

If you want to insert a dynamic IP route into the routing table of the relevant virtual router to point to the subscriber’s subinterface, you can use the Framed-Route [22] RADIUS attribute to do so. Defined by RFC 2865—Remote Authentication Dial In User Service

(RADIUS) (June 2000), the Framed-Route attribute can be returned in Access-Accept messages to specify the route as follows:

Framed-Route = ipAddress/mask nextHop

For dynamic IP interfaces, the next hop might not be known when you create the user record. In this case, use the value 0.0.0.0 for the next hop; the E Series router then assigns the subinterface associated with the user as the next hop in the routing table.

Chapter 17: Configuring Dynamic Interfaces

auto-configure Command

You use the auto-configure command to configure an ATM 1483 subinterface to support a dynamic interface. After the subinterface is configured, it performs autodetection to identify the encapsulation, resulting in the dynamic creation of the higher protocol layers.

This command specifies one or more types of next upper dynamic encapsulations that the static interfaces can detect or accept.

NOTE: On static ATM 1483 interfaces, dynamic encapsulation types can be bridged Ethernet, IP, IPv6, PPP, or PPPoE.

Encapsulation Type Lockout

You can configure E Series routers to support dynamic encapsulation type lockout. With this feature, you can temporarily prevent an ATM 1483 subinterface from autodetecting, accepting, and creating dynamic interface columns for a configurable time period.

On ATM 1483 subinterfaces, encapsulation type lockout is the default behavior for IPoA, bridged Ethernet, PPP, and PPPoE encapsulation types.

Benefits

Using dynamic encapsulation type lockout provides the following benefits:

•

Enables autodetection of other encapsulation types when a dynamic interface for a specified encapsulation type cannot be created.

For example, when running a PPPoE client, DSL modems might transmit bridged

Ethernet frames among the PPPoE frames. When bridged Ethernet and PPPoE encapsulation types are configured for autodetection with the auto-configure command, and a subscriber is configured for the bridged Ethernet encapsulation type,

RADIUS sends a deny response after the router attempts to authenticate a received bridged Ethernet frame. Receiving an authentication denial from RADIUS causes the router to lock out bridged Ethernet. By locking out bridged Ethernet frames, the router can receive PPPoE frames unimpeded, facilitating rapid creation of dynamic PPPoE interfaces.

• Reduces loading on the RADIUS server.

In some cases, IP and bridged Ethernet interfaces configured with a local subscriber do not have a corresponding subscriber entry in the RADIUS database. This can occur inadvertently due to misconfiguration of the E Series router or RADIUS server, or intentionally as a way to prevent creation of dynamic IPoA or bridged Ethernet interfaces.

In previous releases, when the ATM 1483 interface received a deny response from

RADIUS due to the missing subscriber entry, it performed continuous authentication retries every few seconds, which caused significant loading on the RADIUS server.

Locking out autodetection of the IP or bridged Ethernet encapsulation type for a configurable time period prevents detection of dynamic IPoA or bridged Ethernet interfaces and reduces loading on the RADIUS server.

521

JunosE 11.3.x Link Layer Configuration Guide

For PPP and PPPoE encapsulation types, incorrect logins coupled with clients configured to perform frequent authentication retries results in significant loading on the RADIUS server. When an incorrect login occurs, the process of autodetecting, creating partial dynamic interface columns, and tearing down the columns due to authentication failures consumes router bandwidth. Enabling temporary lockout of PPP and PPPoE encapsulation types reduces loading on the RADIUS server caused by incorrect logins and auto-retry clients.

•

Reduces loading on line modules.

The repeated creation of multiple short-cycle dynamic interfaces causes excessive loading on line modules. A short-cycle dynamic interface is one that is detected, partially or completely created, and torn down within 60 seconds.

Events that can cause short-cycle dynamic interfaces include:

•

Authentication denials from RADIUS due to the absence of a corresponding entry in the RADIUS database or due to improper login attempts

• Misconfiguration within a dynamic interface profile or RADIUS record

• Insufficient memory resources to create a dynamic interface column

•

Protocol failure or error that occurs within a dynamic interface column

•

Client logout shortly after a successful login; this action creates a complete dynamic interface column before the column is torn down

How Encapsulation Type Lockout Works

For a given encapsulation type, such as bridged Ethernet, lockout occurs when a dynamic interface of this type cannot be created. For example, an authentication denial from

RADIUS causes a lockout. When lockout occurs, the router applies the lockout time range.

If you do not configure a lockout-time range, the router uses the default time range.

Encapsulation type lockout is performed by default. You can configure the lockout time range by issuing the auto-configure command with the optional lockout-time keyword.

The following guidelines describe lockout behavior:

• Any encapsulation type that you do not configure for autodetection with the auto-configure command is automatically locked out.

•

You can permanently lock out a specified encapsulation type from autodetection and prevent dynamic interface creation by issuing a no auto-configure command for the specified encapsulation type, if previously configured.

• When an encapsulation type is locked out, the router continues to autodetect the remaining encapsulation types and create the dynamic interfaces.

For the IP and bridged Ethernet encapsulation types, temporary lockout occurs automatically on receipt of an authentication deny response from RADIUS when you attempt to create and configure a dynamic IPoA or dynamic bridged Ethernet interface.

Chapter 17: Configuring Dynamic Interfaces

The lockout time range comprises two values: a minimum lockout time and a maximum lockout time. The initial lockout time begins with the minimum lockout time. From this point, the lockout time increases exponentially for every successive lockout event within the greater of 15 minutes or the maximum configured lockout time. The lockout time never exceeds the maximum value of the time range.

For example, using the default lockout time range of 1–300 seconds, the increasing lockout time sequence is: 1 second, 2 seconds, 4 seconds, 8 seconds, 16 seconds, 32 seconds, 64 seconds, 128 seconds, 256 seconds, and finally, 300 seconds (5 minutes).

Encapsulation Type Lockout Based on DSL Forum VSAs for IWF PPPoE Sessions

JunosE Software supports the dynamic encapsulation type lockout functionality for

PPPoE sessions that contain the IWF-Session DSL Forum VSA (26-254) in the PPPoE active discovery request (PADR) packets. For interworking function (IWF) sessions that involve a set of functions to be processed to interconnect two networks of different technologies (such as PPPoE over ATM to PPPoE), the encapsulation type lockout for the PPPoE clients associated with the dynamic PPPoE subinterface column on the PPPoE major interface is determined using a combination of the Agent-Circuit-Id (26-1) and

Agent-Remote-Id (26-2) DSL Forum VSAs, in addition to the MAC address.

The DSL Forum VSAs used in the encapsulation type lockout process for IWF PPPoE sessions comprise Agent-Circuit-Id (26-1) and Agent-Remote-Id (26-2). The

Agent-Circuit-Id VSA is the identifier for the subscriber agent circuit that corresponds to the DSLAM interface from which subscriber requests are initiated. The Agent-Remote-Id

VSA is the unique identifier for the subscriber associated with the DSLAM interface from which requests are initiated. For PPPoE sessions with the IWF-Session VSA, if you configured the pppoe auto-configure lockout-time command in Interface Configuration mode or Subinterface Configuration mode, the MAC address, Agent-Circuit-Id, and

Agent-Remote-Id values are used together to identify a subscriber to implement PPPoE lockout.

If subscriber PPP sessions are transported on PPPoE, the PPPoE intermediate agent on the DSLAM adds the Agent-Circuit-Id and Agent-Remote-Id VSAs to the PPPoE PADI and PADR packets. The PPPoE implementation technique captures both the

Agent-Circuit-Id and the Agent-Remote-Id sub-options from every PADR packet for every

PPPoE session. Dynamic encapsulation type lockout is enabled by default for all IWF

PPPoE sessions.

Guidelines for Configuring Encapsulation Type Lockout for PPPoE sessions

The following rules apply when you configure the lockout time for dynamic encapsulation type lockout:

•

The lockout time value is defined as

(minimum lockout time) * (2 ^ n-1) where n represents the number of consecutive lockout events.

•

The router increments the value of n when the time between lockout events is either within 15 minutes or the maximum lockout time, whichever is greater.

523

JunosE 11.3.x Link Layer Configuration Guide

•

When the time between lockout events is greater than either 15 minutes or the maximum lockout time, the value of n reverts to 1. This condition is referred to as a grace period.

• The lockout time never exceeds the maximum configured lockout time. For example, for a configured lockout time in the range 20–120 seconds, the increasing lockout time sequence is 20 seconds, 40 seconds, 80 seconds, and finally, 120 seconds.

• A short-cycle event is a dynamic interface that is created and torn down within 60 seconds. The router tracks the time between short-cycle events to determine whether to increase the lockout time for a subsequent short-cycle event.

NOTE: When the calculated lockout time is equal to or exceeds the maximum lockout time, the router uses the maximum lockout time value until the time to the next event exceeds the greater of 15 minutes or the maximum lockout time value. At that point, the lockout time reverts to the minimum lockout time value.

• The minimum lockout time value cannot exceed the maximum lockout time value.

When the minimum and maximum values are equal, the encapsulation type lockout time becomes fixed.

Guidelines for Configuring Encapsulation Type Lockout for IWF PPPoE Sessions

Keep the following points in mind while configuring dynamic encapsulation type lockout for IWF PPPoE sessions:

• If the digital subscriber line access multiplexer (DSLAM) network does not add the

DSL Forum VSAs (Agent-Circuit-Id and Agent-Remote-Id) that are required to accurately and uniquely identify the subscriber access loop, dynamic encapsulation type lockout for PPPoE clients is performed using MAC address as the only criterion to identify subscribers.

In such conditions, the mode of working of encapsulation type lockout for PPPoE clients is the same as the behavior that existed when lockout of PPPoE clients was performed using the MAC address of the client as the only matching parameter.

• If the Agent-Circuit-Id DSL Forum VSA (26-1) is not contained in the PADR packet sent from the PPPoE client or is not unique for each IWF PPPoE session that originates from the client, the Agent-Remote-Id DSL VSA (26-2) is used along with the MAC address as the filter criteria to uniquely identify the subscriber session that needs to be locked out.

•

When you enter the pppoe auto-configure lockout-time command in Interface

Configuration mode or Subinterface Configuration mode to configure dynamic encapsulation type lockout, even if PPPoE sessions associated with a particular MAC address are locked out, other PPPoE sessions that originated with the same MAC address are not terminated (continue to remain logged in) if they are IWF sessions from different access loops (PPPoE clients) and this information is available to the

B-RAS application.

Chapter 17: Configuring Dynamic Interfaces

atm pvc Command

You use the atm pvc command to define the underlying circuit supporting an ATM 1483 subinterface. When you define a circuit with this command by using the aal5autoconfig option, it causes the ATM 1483 encapsulation (LLC/SNAP encapsulation or VC multiplexed) to be autodetected. Alternatively, if you use the aal5snap or aal5mux ip option, the ATM 1483 encapsulation becomes fixed, but higher layers can be dynamic.

For example, the following command configures a circuit for autodetection of the ATM

1483 encapsulation and all higher layers.

host1(config-subif)#atm pvc 100 0 100 aal5autoconfig 0 0 0

You can also include the atm pvc command in a base profile assigned to a dynamic ATM

1483 interface to apply encapsulation and traffic-shaping parameters to a bulk-configured

range of PVCs. For information, see “Configuring Dynamic Interfaces Using Bulk

Configuration” on page 619.

Configuration Example for Encapsulation Type Lockout for IWF PPPoE Sessions

Consider a sample configuration scenario in which subscriber access loops are connected

using ATM links to a DSLAM device. Figure 39 on page 393 shows a topology in which one

DSLAM is connected one PPPoE access concentrator. The ATM traffic is forwarded using an Ethernet circuit from the DSLAM device to the PPPoE access concentrator. The PPPoE over ATM or PPP over ATM (PPPoA) traffic is converted to PPPoE by the DSLAM device, which is connected to an ATM access loop on one side and an Ethernet aggregate network on the other side. The interworking function describes the set of mechanisms used to convert a PPPoE over ATM or PPPoA session to a PPPoE session.

The conversion of PPP, PPPoE, Ethernet, ATM 1483, or ATM connections at the DSLAM access loop interface to PPP, PPPoE, or Ethernet connections at the DSLAM aggregate network interface signifies that the MAC addresses of all such IWF sessions are translated to be the MAC address of the DSLAM Ethernet interface connected to the aggregate network. Therefore, you cannot uniquely identify a subscriber using the MAC address only. If the MAC address alone is used to identify a particular subscriber, a single erroneous

IWF session can cause other IWF sessions to be locked out.

In this setup, if the PPPoE session contains the IWF-Session DSL Forum VSA (26-254) in the PPPoE active discovery request (PADR) packet that is sent from the PPPoE client, the Agent-Circuit-Id DSL Forum VSA (26-1) is used in addition to the MAC address to identify the PPPoE session to be locked out. This method enables backward compatibility with all non-IWF topologies. The Agent-Circuit-Id is of the format, DSLAM name Slot/Port

VPI: VCI, which enables unique identification of the subscriber that has initiated the session. This feature of encapsulation type lockout based on the Agent-Circuit-Id, in addition to the MAC address retrieved from the client, is enabled by default only for IWF sessions.

Configuring PPP and PPPoE Dynamic Interfaces over Static ATM

E Series routers support dynamic PPP and PPPoE interfaces. The configuration procedure is very similar for each.

525

JunosE 11.3.x Link Layer Configuration Guide

When using the auto-configure command, select only ppp or pppoe. The router automatically builds the necessary interfaces for you. When you indicate pppoe, on receipt of a PPPoE packet, the dynamic interface built is IP over PPP over PPPoE over

ATM. Likewise, when you indicate ppp, the dynamic interface built is IP over PPP over

ATM.

Figure 47 on page 526 shows dynamic PPP interface columns on ATM interfaces.

Figure 47: Dynamic PPP Interface Columns

Figure 48 on page 526 shows dynamic PPPoE interface columns and illustrates how PPPoE

supports multiple IP sessions over each ATM 1483 circuit.

Figure 48: Dynamic PPPoE Interface Columns

Chapter 17: Configuring Dynamic Interfaces

You can specify either or both ppp and pppoe for the interface by specifying the auto-configure command for each type of interface. The first packet received defines the type of dynamic interface that is created.

Configuring a PPP or PPPoE Dynamic Interface

To configure an ATM 1483 subinterface to support a PPP or PPPoE dynamic interface:

Configure a physical interface.

host1(config)#interface atm 5/0

Configure an ATM 1483 subinterface.

host1(config-if)#interface atm 5/0.1

Configure a PVC by specifying the virtual circuit descriptor (VCD), the virtual path identifier (VPI), the virtual channel identifier (VCI), and the encapsulation type.

If you want the router to autodetect the encapsulation type, use the aal5autoconfig option.

host1(config-subif)#atm pvc 10 100 22 aal5snap host1(config-subif)#atm pvc 10 100 22 aal5autoconfig

Assign a profile to the PPP or PPPoE encapsulation types.

host1(config-subif)#profile ppp foo host1(config-subif)#profile pppoe foo

Configure the subinterface to detect and accept dynamic PPP or PPPoE.

host1(config-subif)#auto-configure ppp host1(config-subif)#auto-configure pppoe

In addition to ppp and pppoe, you can also specify ip or bridgedEthernet.

(Optional) Verify your configuration.

host1#show atm subinterface atm 5/0.1

atm pvc

•

Use to configure a PVC on an ATM interface. Specify one of the following encapsulation types:

• aal5autoconfig—Enables autodetection of the 1483 encapsulation (LLC/SNAP or

VC multiplexed).

• aal5snap—Specifies a logical link control (LLC) encapsulated circuit; the

LLC/Subnetwork Access Protocol (LLC/SNAP) header precedes the protocol datagram.

• aal5mux ip—Specifies a VC multiplexed circuit. This option is used for IP only.

•

Example host1(config-subif)#atm pvc 6 0 11 aal5autoconfig

•

Use the no version to remove the specified PVC.

•

See atm pvc.

527

JunosE 11.3.x Link Layer Configuration Guide

auto-configure

528

•

Use to configure a static ATM 1483 subinterface to support a dynamic interface.

Specifies the types of dynamic encapsulation that the subinterface detects and accepts.

•

This command creates the layers above ATM 1483 dynamically.

•

You can enter the command repetitively to support multiple dynamic interface types.

•

Select the dynamic next upper-interface type from these options: bridgedEthernet, ip, ppp, or pppoe.

•

Encapsulation type lockout is performed on a per-encapsulation-type basis for each subinterface. An encapsulation type not configured for autodetection with the auto-configure command is automatically locked out. The lockout temporarily prevents the static ATM 1483 subinterface from detecting, accepting, and creating the encapsulation type until the lockout time expires.

•

Use the lockout-time keyword to set the minimum lockout time and maximum lockout time, each of which can be in the range 1–86400 seconds (24 hours).The default range is 1–300 seconds (5 minutes).

•

Use the none keyword to disable lockout for the specified encapsulation type.

NOTE: Disabling lockout can result in undesirable CPU loading; we recommend that you not disable lockout for general use. At a minimum, use the default lockout time.

•

For information about the rules that apply when you configure the lockout time for

dynamic encapsulation type lockout, see “Guidelines for Configuring Encapsulation

Type Lockout for PPPoE sessions” on page 523.

•

Example 1—Enables autodetection for the PPPoE encapsulation type using the default lockout time range, 1–300 seconds host1(config-subif)#auto-configure pppoe

•

Example 2—Enables autodetection for the PPP encapsulation type using a nondefault lockout time range, 5–60 seconds host1(config-subif)#auto-configure ppp lockout-time 5 60

•

Example 3—Disables encapsulation type lockout for the PPPoE encapsulation type host1(config-subif)#auto-configure pppoe lockout-time none

•

Example 4—Either command reenables encapsulation type lockout for the PPPoE encapsulation type using the default lockout time range host1(config-subif)#auto-configure pppoe host1(config-subif)#no auto-configure pppoe lockout-time

•

Example 5—Permanently locks out the PPP encapsulation type until the auto-configure ppp command is issued host1(config-subif)#no auto-configure ppp

Chapter 17: Configuring Dynamic Interfaces

interface atm profile

•

Use the no version to terminate detection of the specified encapsulation type or, if the lockout-time keyword is specified, to restore the lockout time range to its default value,

1–300 seconds.

•

See auto-configure.

•

Use to select an ATM interface or ATM 1483 subinterface.

•

To specify an ATM interface for ERX7xx models, ERX14xx models, and ERX310 router, use the slot/port.[subinterface ] format.

•

slot—Number of the chassis slot

•

port—Port number on the I/O module

•

subinterface—Number of the subinterface in the range 1–2147483647

•

To specify an ATM interface for E120 and E320 routers, use the

slot/adapter/port[.subinterface ] format.

•

slot—Number of the chassis slot

•

adapter—Identifier for the IOA within the E320 chassis, either 0 or 1, where:

•

0 indicates that the IOA is installed in the right IOA bay (E120 router) or the upper

IOA bay (E320 router).

•

1 indicates that the IOA is installed in the left IOA bay (E120 router) or the lower

IOA bay (E320 router).

•

port—Port number on the IOA

•

subinterface—Number of the subinterface in the range 1–2147483647

•

For more information, see “Creating a Basic Configuration” on page 21 in “Configuring

ATM” on page 3.

•

Examples host1(config)#interface atm 5/0.1

host1(config)#interface atm 5/0/0.1

•

Use the no version to remove the interface or subinterface.

•

See interface atm.

•

Use to assign a profile.

•

You must specify the encapsulation type to which the profile applies: bridgedEthernet, ip, ppp, pppoe ,or any.

•

Specify a profile name with up to 80 alphanumeric characters.

•

Example host1(config-subif)#profile ppp foo

529

JunosE 11.3.x Link Layer Configuration Guide

•

Use the no version to remove a profile assignment.

•

See profile.

Terminating Stale PPPoA Subscribers and Restarting LCP Negotiations

In configurations of dynamic IP over dynamic PPP over a static ATM 1483 subinterface,

as shown in Figure 47 on page 526, any of the following conditions might cause the static

ATM 1483 subinterface to transition to a dormant state as the result of an ungraceful subscriber logout:

•

Rebooting the router

• Rebooting a line module

• Transitioning the physical (for example, SONET) interface, ATM major interface, or

ATM AAL5 interface from up to down to up again

•

Transitioning the ATM 1483 subinterface or the ATM PVC from up to down to up again

• Any other lowerLayerDown operational status condition that affects the dynamic PPP interface; a lowerLayerDown status indicates that a lower-layer interface below the dynamic PPP interface is down

When the ATM 1483 subinterface transitions to a dormant state as a result of any of these conditions, the router tears down the dynamic PPP interface column. The dynamic

PPP interface is unable to send an LCP terminate request to its peer because its own lower-layer interface is down. This action causes a loss of connectivity between the router and the PPPoA customer premises equipment (CPE). If the CPE supports the PPP keepalive feature, it can detect the loss of connectivity and restart Link Control Protocol

(LCP) negotiations in order to initiate a new connection. However, if the CPE does not support PPP keepalive, it cannot detect that the connection is down, and continues to send PPP data packets to the router.

On receipt of an IPv4-over-PPP data packet or an IPv6-over-PPP data packet from the

CPE when the ATM 1483 subinterface transitions to a dormant state, the router sends an LCP terminate request packet to the CPE. Receipt of the LCP terminate request packet causes the CPE to restart LCP negotiations in order to initiate a new connection. After the CPE restarts LCP negotiations, the router recreates the dynamic PPP and IP upper-layer interfaces above the static ATM 1483 subinterface. This behavior is always in effect on the router and does not require CLI or SNMP configuration.

Sending an LCP terminate request packet in response to receipt of an IPv4-over-PPP data packet or an IPv6-over-PPP data packet from a PPPoA CPE device offers the following benefits:

• For CPEs that support PPP keepalive, receipt of an LCP terminate request packet from the router restarts the LCP negotiations more quickly.

•

For CPEs that do not support PPP keepalive, receipt of an LCP terminate request packet from the router enables the CPE to detect the connection termination and restart LCP negotiations in response.

Chapter 17: Configuring Dynamic Interfaces

The router also sends an LCP terminate request packet to a PPPoA CPE device in configurations of dynamic IP over dynamic PPP over a dynamic (bulk-configured) ATM

1483 subinterface. For more information, see “Terminating Stale PPPoA Subscribers and

Restarting LCP Negotiations” on page 631 in “Configuring Dynamic Interfaces Using Bulk

Configuration” on page 619.

Configuring PPPoE Dynamic Interfaces over PPPoE Static Interfaces

E Series routers support dynamic PPPoE subinterfaces over static PPPoE major interfaces.

The PPPoE major interfaces can be created over:

•

ATM

• Ethernet

• Ethernet with VLANs

•

Ethernet with S-VLANs

The following sections describe how to create each of these configurations on the router.

In addition, “Configuring Encapsulation Type Lockout for PPPoE Clients” on page 544

describes how to configure dynamic encapsulation type lockout for PPPoE clients associated with dynamic PPPoE subinterface columns.

Configuring Dynamic PPPoE over Static PPPoE with ATM Interface Columns

Figure 49 on page 531 shows dynamic PPPoE subinterface columns and illustrates an

alternative method for PPPoE to support multiple IP sessions over each ATM 1483 circuit.

Figure 49: Dynamic PPPoE over Static PPPoE with ATM Interface Columns

To configure an ATM 1483 subinterface to support a dynamic PPPoE subinterface:

531

JunosE 11.3.x Link Layer Configuration Guide

Configure a physical interface.

host1(config)#interface atm 5/0

Configure an ATM 1483 subinterface.

host1(config-if)#interface atm 5/0.1

Configure a PVC by specifying the virtual circuit descriptor (VCD), the virtual path identifier (VPI), the virtual channel identifier (VCI), and the encapsulation type.

If you want the router to autodetect the encapsulation type, use the aal5autoconfig option.

host1(config-subif)#atm pvc 10 100 22 aal5snap host1(config-subif)#atm pvc 10 100 22 aal5autoconfig

Set the encapsulation type to PPPoE to create the PPPoE major interface.

host1(config-subif)#encapsulation pppoe

Assign a profile.

host1(config-subif)#pppoe profile pppoeProfile1

Configure the interface to detect and accept dynamic PPPoE subinterfaces.

host1(config-subif)#pppoe auto-configure

When you configure dynamic encapsulation type lockout for PPPoE sessions that contain the IWF-Session DSL Forum VSA (26-254) in the PPPoE active discovery request (PADR) packets, even if PPPoE sessions associated with a particular MAC address are locked out, other PPPoE sessions that originated with the same MAC address are not terminated (continue to remain logged in) if they are IWF sessions from different access loops (PPPoE clients) and this information is available to the

B-RAS application.

(Optional) Verify your configuration.

host1#show atm subinterface atm 5/0.1

host1#show pppoe interface atm 5/0.1

Configuring Dynamic PPPoE over Static PPPoE with Ethernet Interface Columns

Figure 50 on page 533 shows dynamic PPPoE subinterface columns configured over an

Ethernet interface without VLANs.

Chapter 17: Configuring Dynamic Interfaces

Figure 50: Dynamic PPPoE over Static PPPoE with Non-VLAN Interface

Columns

To configure an Ethernet interface without VLANs to support a dynamic PPPoE subinterface:

Specify a Fast Ethernet, Gigabit Ethernet, or 10-Gigabit Ethernet interface.

host1(config)#interface fastEthernet 4/1

Assign an IP address and mask.

host1(config-if)#ip address 192.6.129.5 255.255.255.0

Specify PPPoE as the encapsulation method on the interface.

host1(config-subif)#encapsulation pppoe

This command creates the static PPPoE major interface.

Assign a profile to the PPPoE major interface.

host1(config-subif)#pppoe profile pppoeProfile3

Configure the interface to detect and accept dynamic PPPoE subinterfaces.

host1(config-subif)#pppoe auto-configure

Configuring Dynamic PPPoE over Static PPPoE with Ethernet and VLAN Interface Columns

Figure 51 on page 534 shows dynamic PPPoE subinterface columns and illustrates an

alternative method for PPPoE to support multiple IP sessions over each VLAN.

533

JunosE 11.3.x Link Layer Configuration Guide

Figure 51: Dynamic PPPoE over Static PPPoE with VLAN Interface Columns

To configure a VLAN subinterface to support a dynamic PPPoE subinterface:

Specify a Fast Ethernet, Gigabit Ethernet, or 10-Gigabit Ethernet interface.

host1(config)#interface fastEthernet 4/1

Specify VLAN as the encapsulation method.

host1(config-if)#encapsulation vlan

This command adds the VLAN major interface.

Create a VLAN subinterface by adding a subinterface number to the interface identifier.

host1(config-if)#interface fastEthernet 4/1.1

Assign a VLAN ID for the subinterface.

host1(config-if)#vlan id 400

Set the encapsulation type to PPPoE.

host1(config-subif)#encapsulation pppoe

Assign a profile.

host1(config-subif)#pppoe profile pppoeProfile2

Configure the interface to detect and accept dynamic PPPoE subinterfaces.

host1(config-subif)#pppoe auto-configure

Configuring IPv4 and IPv6 over Static and Dynamic PPPoE

You can configure IPv4 and IPv6 interface columns over static and dynamic PPPoE, as

shown in Figure 52 on page 535.

Chapter 17: Configuring Dynamic Interfaces

Figure 52: IPv4 and IPv6 Interface Columns over Static and Dynamic

PPPoE

IPv4 IPv6 IPv6 IPv4 IPv6 IPv4

Gigabit Ethernet

To configure IPv4 and IPv6 interface columns over dynamic PPPoE:

Specify the loopback mode for an interface and assign both IPv6 and IPv4 addresses to the interface.

host1(config)#interface loopback 1 host1(config-if)#ipv6 address 2000::1/64 host1(config-if)#ip address 2.2.2.1/24

Create a profile that defines attributes for the dynamic interface. You can use this profile to configure IPv4 or IPv6, or both IPv4 and IPv6 PPP interfaces.

host1(config)#profile ipv4Ipv6Profile host1(config-profile)#ip virtual-router ppp host1(config-profile)#ip unnumbered loopback 1 host1(config-profile)#ipv6 virtual-router ppp host1(config-profile)#ipv6 unnumbered loopback 1 host1(config-profile)#ipv6 nd other-config-flag host1(config-profile)#ipv6 nd ra-interval 10 host1(config-profile)#ppp authentication chap host1(config-profile)#exit

Specify the interface.

host1(config-if)#interface gigabitEthernet 4/0/6

Set the encapsulation type to PPPoE.

host1(config-subif)#pppoe

Configure the interface to detect and accept dynamic PPPoE subinterfaces.

host1(config-subif)#pppoe auto-configure

Assign the profile to any autoconfigured encapsulation.

host1(config-if)#pppoe profile any ipv4Ipv6Profile

535

JunosE 11.3.x Link Layer Configuration Guide

interface loopback ip address ip unnumbered ip virtual-router

•

Use to access and configure the loopback interface.

•

Provides a stable address to minimize impact of a physical interface going down.

•

Example host1(config)#interface loopback 20 host1(config-if)#ip address 10.10.20.5 255.255.255.254

•

Use the no version to delete the loopback interface.

•

See interface loopback.

•

Use to assign an IP address and subnet mask to a subinterface.

•

Example host1(config-if)#ip address 10.10.20.5 255.255.255.254

•

Use the no version to remove an IP address or to disable IP processing.

•

See ip address.

•

Use to specify the numbered interface with which dynamic unnumbered interfaces created with the profile are associated.

•

You can specify an unnumbered interface using RADIUS instead of using the ip unnumbered command in a profile. For more information about how to specify an unnumbered interface using RADIUS, see Configuring RADIUS Attributes in the JunosE

Broadband Access Configuration Guide.

•

Example host1(config-profile)#ip unnumbered fastEthernet 0/0

•

Use the no version to remove the assignment from the profile.

•

See ip unnumbered

•

Use to assign a virtual router to a profile.

•

You can configure a virtual router using RADIUS instead of adding one to the profile by using the ip virtual-router command. For more information about how to configure a virtual router using RADIUS, see Configuring RADIUS Attributes in the JunosE Broadband

Access Configuration Guide.

•

Example host1(config-profile)#ip virtual-router VR1

•

Use the no version to remove the virtual router assignment.

•

See ip virtual-router

Chapter 17: Configuring Dynamic Interfaces

ipv6 address ipv6 nd ipv6 unnumbered

•

Use to add an IPv6 address to an interface or a subinterface.

•

Example host1(config)#interface gigabitEthernet 1/0.25

host1(config-if)#ipv6 address 1::1/64

•

Use the no version to remove an IPv6 address.

•

See ipv6 address

•

Use to enable the IPv6 Neighbor Discovery process on an interface.

•

You can include the following commands in IPv6 profiles to configure Neighbor

Discovery route advertisement characteristics.

Command Description ipv6 nd ipv6 nd other-config-flag ipv6 nd ra-interval

Enables Neighbor Discovery on an interface

Sets the “other stateful configuration” flag in IPv6 router advertisements

Configures the interval between IPv6 router advertisements

•

Example host1(config)#profile ProfileIpv6South22 host1(config-profile)#ipv6 nd

•

Use the no version to disable the Neighbor Discovery process for the profile.

•

See ipv6 nd

•

Use to set up an unnumbered interface.

•

An unnumbered interface does not have an IPv6 address assigned to it. Unnumbered interfaces are often used in point-to-point connections where an IPv6 address is not required.

•

This command enables IPv6 processing on an interface without your having to assign an explicit IPv6 address to the interface.

•

You supply an interface location that is the type and number of another interface on which the router has an assigned IPv6 address. This interface cannot be another unnumbered interface.

•

Example host1(config-if)#ipv6 unnumbered loopback 0

•

Use the no version to disable IPv6 processing on an interface.

•

See ipv6 unnumbered

537

JunosE 11.3.x Link Layer Configuration Guide

ipv6 virtual-router ppp authentication pppoe

•

Use to assign a virtual router to a profile.

•

You can configure a virtual router using RADIUS instead of adding one to the profile by using the ipv6 virtual-router command. For more information about how to configure a virtual router using RADIUS, see Configuring RADIUS Attributes in the JunosE Broadband

Access Configuration Guide.

•

Example host1(config-profile)#ipv6 virtual-router VR6

•

Use the no version to remove the virtual router assignment.

•

See ipv6 virtual-router

•

Use to request authentication from a PPP peer and set the authentication method.

•

The router supports the MD5 authentication algorithm for CHAP authentication.

•

Example 1—Specifies the order of preference for the primary authentication protocol host1(config-if)#ppp authentication pap chap eap

The router requests the use of PAP as the authentication protocol (because it appears first in the command line). If the peer refuses to use PAP, the router requests the CHAP protocol. If the peer refuses to use CHAP, the router requests the EAP protocol. If the peer refuses to negotiate authentication, the router terminates the PPP session.

•

Example 2—Configures EAP or CHAP or PAP on a dynamic PPP interface host1(config)#profile ppptest host1(config-profile)#ppp authentication eap chap pap

In this example, the router first attempts EAP negotiation. If PPP receives a NAK from the peer in response to the EAP request, then the router attempts CHAP negotiation.

If PPP receives a NAK from the peer in response to the CHAP request, then the router attempts PAP negotiation. If PAP is also rejected, then PPP terminates the session.

•

Use the no version to specify that the router does not require authentication.

•

See ppp authentication.

•

Use to specify PPPoE as the encapsulation method for the interface.

•

This command creates a PPPoE major interface.

•

Example host1(config-if)#pppoe

•

Use the no version to remove the PPPoE major interface.

•

See pppoe.

profile

Chapter 17: Configuring Dynamic Interfaces

•

Use from Global Configuration mode to create a profile. You can specify a profile name of up to 80 characters.

•

Use from Interface Configuration mode or Subinterface Configuration mode to assign a profile to a PPP interface. The profile configuration is used to dynamically create an upper IP interface.

•

Example 1–Creates a profile named foo.

host1(config)#profile foo

•

Example 2–Assigns a profile named action to a PPP interface.

host1(config-if)#interface gigabitEthernet 2/1 host1(config-if)#encapsulation ppp host1(config-if)#profile action

•

Use the no version from Global Configuration mode to remove a profile.

•

Use the no version from Interface Configuration mode or Subinterface Configuration mode to remove a profile assignment from an interface.

•

See profile

Configuring Dynamic PPPoE over Static PPPoE with Ethernet and S-VLAN Interface Columns

Figure 53 on page 539 shows dynamic PPPoE subinterface columns over PPPoE major

interfaces using S-VLANs over Ethernet.

Figure 53: Dynamic PPPoE over Static PPPoE with S-VLAN Interface

Columns

To configure an S-VLAN subinterface to support a dynamic PPPoE subinterface:

Specify a Fast Ethernet, Gigabit Ethernet, or 10-Gigabit Ethernet interface.

host1(config)#interface fastEthernet 4/1

539

JunosE 11.3.x Link Layer Configuration Guide

Specify VLAN as the encapsulation method.

host1(config-if)#encapsulation vlan

This command creates the VLAN major interface.

Create a VLAN subinterface by adding a subinterface number to the interface identifier.

host1(config-if)#interface fastEthernet 3/1.1

Assign an S-VLAN ID and a VLAN ID for the subinterface.

host1(config-if)#svlan id 3 300

Assign an S-VLAN Ethertype.

host1(config-if)#svlan ethertype 9200

Specify PPPoE as the encapsulation method on the interface.

host1(config-subif)#encapsulation pppoe

This command creates the PPPoE major interface.

Assign a profile.

host1(config-subif)#pppoe profile pppoeProfile3

Configure the interface to detect and accept dynamic PPPoE subinterfaces.

host1(config-subif)#pppoe auto-configure

S-VLAN Oversubscription

When you configure S-VLAN subinterfaces over Ethernet interfaces to support dynamic

PPPoE subinterfaces, you can take advantage of S-VLAN oversubscription.

The maximum number of S-VLANs that you can create per I/O module or IOA with PPPoE major interfaces stacked over them is greater than the maximum number of dynamic

PPPoE subinterfaces. The maximum number of PPP interfaces supported per line module is directly proportional to the maximum number of PPPoE subinterfaces.

As a result, you can oversubscribe S-VLANs by configuring up to the maximum number of S-VLANs supported on the I/O module or IOA, knowing that no more than the maximum number of supported PPP sessions can be connected to the router at any one time.

For information about the module combinations that support S-VLAN oversubscription,

see “S-VLAN Oversubscription” on page 185 in “Configuring VLAN and S-VLAN

Subinterfaces” on page 167.

For specific information about the maximum number of S-VLANs supported per I/O module or IOA and the maximum number of PPP interfaces and PPPoE subinterfaces supported per line module, see JunosE Release Notes, Appendix A, System Maximums.

Chapter 17: Configuring Dynamic Interfaces

NOTE: S-VLAN oversubscription is not currently supported for S-VLANs configured over bridged Ethernet interfaces.

The E120 and E320 routers can support up to two IOAs per line module. This maximum number of S-VLANs per line module does not change whether one or two IOAs are installed. For more information about configuration options for the ES2-S1 GE-4 IOA, see chapter Configuring Ethernet Interfaces in JunosE

Physical Layer Configuration Guide.

atm pvc encapsulation pppoe

•

Use to configure PPPoE as the encapsulation method for the interface.

•

Example host1(config-if)#encapsulation pppoe

•

Use the no version to remove PPPoE encapsulation from the interface.

•

See encapsulation pppoe.

encapsulation vlan

•

Use to configure a PVC on an ATM interface. Specify one of the following encapsulation types:

• aal5autoconfig—Enables autodetection of the 1483 encapsulation (LLC/SNAP or

VC multiplexed).

• aal5snap—Specifies a logical link control (LLC) encapsulated circuit; the

LLC/Subnetwork Access Protocol (LLC/SNAP) header precedes the protocol datagram.

• aal5mux ip—Specifies a VC multiplexed circuit. This option is used for IP only.

•

Example host1(config-subif)#atm pvc 6 0 11 aal5autoconfig

•

Use the no version to remove the specified PVC.

•

See atm pvc.

•

Use to configure VLAN as the encapsulation method for the interface.

•

Example host1(config-if)#encapsulation vlan

•

Use the no version to remove VLAN encapsulation from the interface.

•

See encapsulation vlan.

interface atm

541

JunosE 11.3.x Link Layer Configuration Guide

•

Use to select an ATM interface or ATM 1483 subinterface.

•

For information about specifying the ATM interface or subinterface, see “interface atm” on page 529.

•

Examples host1(config)#interface atm 5/0.1

host1(config)#interface atm 4/0/2.1

•

Use the no version to remove the interface or subinterface.

•

See interface atm.

interface fastEthernet

•

Use to select a Fast Ethernet interface.

•

Example host1(config)#interface fastEthernet 4/1

•

Use the no version to remove IP from an interface or a subinterface. You must issue the no version from the highest level down; you cannot remove an interface or a subinterface if the one above it still exists.

•

See interface fastEthernet.

interface gigabitEthernet interface tenGigabitEthernet

•

Use to select a Gigabit Ethernet interface or a 10-Gigabit Ethernet interface.

•

To specify a Gigabit Ethernet interface for ERX7xx models, ERX14xx models, and ERX310 router, use the slot/port[.subinterface ] format.

•

To specify a Gigabit Ethernet interface or a 10-Gigabit Ethernet interface for E120 and

E320 routers, use the slot/adapter/port[.subinterface ] format.

•

For more information, see chapter Configuring Ethernet Interfaces in JunosE Physical

Layer Configuration Guide.

•

Examples host1(config)#interface gigabitEthernet 1/0 host1(config)#interface gigabitEthernet 4/0/1 host1(config)#interface tenGigabitEthernet 4/0/1

•

Use the no version to remove IP from an interface. You must issue the no version from the highest level down; you cannot remove an interface or subinterface if the one above it still exists.

•

See interface gigabitEthernet.

•

See interface tenGigabitEthernet.

ip address

Chapter 17: Configuring Dynamic Interfaces

pppoe auto-configure

•

Use to set up the router to dynamically create PPPoE subinterfaces on the PPPoE major interfaces.

•

Example host1(config-subif)#pppoe auto-configure

•

Use the no version to remove this configuration.

•

See pppoe auto-configure.

pppoe profile

•

Use to assign an IP address and subnet mask to an interface or a subinterface.

•

Example host1(config-if)#ip address 192.1.1.1 255.255.255.0

•

Use the no version to remove an IP address or disable IP processing.

•

See ip address.

•

Use to assign a profile to a static PPPoE major interface. The profile configuration is used to dynamically configure an upper bridged Ethernet, IP, PPP, or PPPoE interface.

•

Specify a profile name with up to 80 alphanumeric characters.

•

The default encapsulation type, any, applies to any autoconfigured encapsulation that does not have a specific profile assignment.

•

Examples host1(config-subif)#pppoe profile pppoeProfile4 host1(config-if)#pppoe profile any anyProfile

•

Use the no version to remove the profile assignment from the interface.

•

See pppoe profile.

svlan ethertype

•

Use to assign an Ethertype value for the S-VLAN subinterface.

•

Choose one of the following Ethertype values:

•

8100—Specifies Ethertype value 0x8100, as defined in IEEE Standard 802.1q

•

9100—Specifies Ethertype value 0x9100, which is the default

•

9200—Specifies Ethertype value 0x9200

•

Use an Ethertype value that matches the Ethertype value set on the customer premises equipment (CPE) to which your router connects.

•

Example host1(config-if)#svlan ethertype 8100

543

JunosE 11.3.x Link Layer Configuration Guide

•

Use the no version to restore the default value, 9100.

•

See svlan ethertype.

svlan id

•

Use to assign S-VLAN IDs and VLAN IDs to VLAN subinterfaces.

•

Use S-VLAN ID and VLAN ID numbers that are in the range 0–4095 and that are unique within the Ethernet interface.

•

Issue the svlan id command before any upper bindings are made, such as IP or PPPoE.

•

Example host1(config-if)#svlan id 4 255

•

There is no no version.

•

See svlan id.

vlan id

•

Use to specify the VLAN ID.

•

Use a VLAN ID that is in the range 0–4095 and is unique within the Ethernet interface.

•

Issue the vlan id command before any upper bindings are made, such as IP or PPPoE.

•

Use the optional keyword untagged to specify that frames be sent untagged. The keyword is valid only for VLAN ID 0, which can receive tagged frames but sends out untagged frames.

•

Example host1(config-if)#vlan id 400

•

There is no no version.

•

See vlan id.

Configuring Encapsulation Type Lockout for PPPoE Clients

In configurations with dynamic PPPoE subinterfaces over static PPPoE major interfaces, you can configure dynamic encapsulation type lockout for the PPPoE clients associated with a dynamic PPPoE subinterface column. Using this feature enables you to temporarily prevent the static PPPoE major interface from autodetecting, accepting, and creating dynamic PPPoE subinterface columns for a configurable time period.

By default, encapsulation type lockout is disabled for PPPoE clients. To configure a lockout time range for the PPPoE clients associated with the dynamic PPPoE subinterface columns on the PPPoE major interface, use the pppoe auto-configure command with the lockout-time keyword. You can also use the show pppoe interface lockout-time command to display detailed information about the current lockout condition for each

PPPoE client, and the pppoe clear lockout interface command to clear (reset) the lockout condition for an individual PPPoE client.

Chapter 17: Configuring Dynamic Interfaces

For information about the working of the dynamic encapsulation type lockout feature for PPPoE sessions that contain the IWF-Session DSL Forum VSA (26-254) in PADR

packets, see “Encapsulation Type Lockout Based on DSL Forum VSAs for IWF PPPoE

Sessions” on page 523.

For illustrations of the interface stacking in dynamic PPPoE over static PPPoE

configurations, see Figure 49 on page 531, Figure 50 on page 533, Figure 51 on page 534, and

Figure 53 on page 539.

Differences from Lockout Configuration for PPPoE over Static ATM

Table 29 on page 545 lists the important differences between how encapsulation type

lockout works for dynamic PPPoE over static PPPoE configurations and how lockout works for dynamic PPPoE over static ATM 1483 configurations.

Table 29: Differences in Lockout Operation for Dynamic PPPoE

Configurations

Dynamic PPPoE over Static PPPoE Dynamic PPPoE over Static ATM 1483

Encapsulation type lockout is disabled by default.

Encapsulation type lockout is enabled by default with a lockout time range of 1–300 seconds.

You must explicitly configure encapsulation type lockout for PPPoE clients with the pppoe auto-configure command.

PPPoE clients automatically inherit their lockout setting from the lockout parameters configured for the underlying static ATM 1483 subinterface with the auto-configure command.

Currently, the dynamic PPPoE interface layer must be configured directly above the static ATM 1483 interface layer to support inheritance of lockout parameters. For an illustration of dynamic PPPoE

over static ATM 1483 interface stacking, see Figure

48 on page 526.

For more information about the benefits and operation of dynamic encapsulation type

lockout, see “Encapsulation Type Lockout” on page 521. In particular, see “Guidelines for

Configuring Encapsulation Type Lockout for PPPoE sessions” on page 523 for information

about the rules that apply when you configure the lockout time. These rules are common to both dynamic PPPoE over static PPPoE configurations and dynamic PPPoE over static

ATM 1483 configurations.

Configuration Tasks

Configuring dynamic encapsulation type lockout for PPPoE clients includes the following tasks:

• Configuring and verifying lockout for PPPoE clients

•

Clearing the lockout condition for a specific PPPoE client

Configuring and Verifying Lockout for PPPoE Clients

To configure and verify encapsulation type lockout for a PPPoE client:

545

JunosE 11.3.x Link Layer Configuration Guide

546

Configure the underlying physical interface.

For example, the following commands configure a static ATM 1483 subinterface and corresponding ATM PVC.

host1(config)#interface atm 3/0 host1(config-if)#interface atm 3/0.101

host1(config-subif)#atm pvc 10 10 20 aal5snap

Create a static PPPoE major interface.

host1(config-subif)#encapsulation pppoe

Configure the PPPoE major interface to detect and accept dynamic PPPoE subinterfaces. Use the lockout-time keyword to configure a nondefault lockout time range for the PPPoE clients associated with the dynamic PPPoE subinterface column.

For example, the following command configures a lockout time in the range

5–60 seconds for the PPPoE clients associated with the dynamic PPPoE subinterface column on the PPPoE major interface.

host1(config-subif)#pppoe auto-configure lockout-time 5 60

Assign a profile to the PPPoE major interface.

host1(config-subif)#pppoe profile pppoeLockoutProfile

For information about creating and using profiles, see “Configuring a Dynamic Interface from a Profile” on page 559.

(Optional) Verify the lockout configuration by using either of the following commands.

• To display summary information about the lockout configuration, use the show pppoe interface command. (The following example shows only the portion of the command display relevant to the PPPoE lockout configuration.) host1# show pppoe interface atm 3/0.101

PPPoE interface ATM 3/0.101 is operStatusUp (dynamic)

. . .

Lockout Configuration (seconds): Min 5, Max 60

Total clients in active lockouts: 0

Total clients in lockout grace period: 0

• To display detailed information about the current lockout condition for each PPPoE client associated with a specific source media access control (MAC) address, use the show pppoe interface lockout-time command.

This command displays multiple entries for the same MAC address if multiple IWF sessions contain the same MAC address. In the following example, more than one entry for the same PPPoE client MAC address, 0090.1a42.527c, is displayed under the Client Address column head. This method of display occurs because the MAC address in the Client Address field denotes the MAC address of the DSLAM device at which multiplexing functions are performed and not the address of the originating

PPPoE client (access loop) for PPPoE sessions that contain the IWF-Session DSL

Forum VSA (26-154).

host1# show pppoe interface atm 12/1/1.1.1 lockout-time

PPPoE interface atm 12/1/1.1

Lockout Configuration (seconds): Min 90, Max 120

Chapter 17: Configuring Dynamic Interfaces

Total clients in active lockout: 1

Total clients in lockout grace period: 0

Client Address Current Elapsed Next

-------------- ------- ------- ----

0090.1a42.527c 120 30 120

0090.1a42.527c 0 0 90

For a description of the fields in the command display, see “show pppoe interface”

on page 602 and “show pppoe interface lockout-time” on page 603.

pppoe auto-configure lockout-time

•

Use to specify the lockout time range for the PPPoE clients associated with the dynamic

PPPoE subinterface column on the static PPPoE major interface.

•

Dynamic encapsulation type lockout is disabled for PPPoE clients by default.

•

Configuring dynamic encapsulation type lockout temporarily prevents the static PPPoE major interface from detecting, accepting, and creating dynamic PPPoE subinterface columns until the lockout time expires.

•

Use the lockout-time keyword to set the minimum lockout time and maximum lockout time, each of which can be in the range 1–86400 seconds (24 hours).

•

Use the none keyword to disable lockout for the PPPoE clients associated with the dynamic PPPoE subinterface column on the static PPPoE major interface.

•

For information about the rules that apply when you configure the lockout time for

dynamic encapsulation type lockout, see “Guidelines for Configuring Encapsulation

Type Lockout for PPPoE sessions” on page 523.

•

Example 1—Enables dynamic creation of PPPoE subinterfaces on the static PPPoE major interface using a nondefault lockout time range, 10–120 seconds host1(config-subif)#pppoe auto-configure lockout-time 10 120

•

Example 2—Disables dynamic encapsulation type lockout for any PPPoE clients associated with the dynamic PPPoE subinterface column on the static PPPoE major interface host1(config-subif)#pppoe auto-configure lockout-time none

•

Example 3—Terminates dynamic creation of PPPoE subinterfaces on the static PPPoE major interface and, by extension, disables dynamic encapsulation type lockout for this interface host1(config-subif)#no pppoe auto-configure

•

Use the no pppoe auto-configure command to terminate dynamic creation of PPPoE subinterfaces on the static PPPoE major interface.

•

See pppoe auto-configure.

Clearing the Lockout Condition for a PPPoE Client

You can use the pppoe clear lockout interface command to clear the lockout condition for an individual PPPoE client associated with a dynamic PPPoE subinterface column

547

JunosE 11.3.x Link Layer Configuration Guide

548 on a static PPPoE major interface. To identify the PPPoE client, you must specify its source MAC address.

For information about the working of the dynamic encapsulation type lockout feature for PPPoE sessions that contain the IWF-Session DSL Forum VSA (26-254) in PADR

packets, see “Encapsulation Type Lockout Based on DSL Forum VSAs for IWF PPPoE

Sessions” on page 523.

NOTE: Issuing the pppoe clear lockout interface command resets the current lockout condition for the specified PPPoE client, but does not disable dynamic encapsulation type lockout for that PPPoE client.

To clear the current lockout condition for a PPPoE client:

Display the source MAC address assigned to the PPPoE client by issuing one of the following show commands:

•

To display the source MAC address when there is no available PPPoE session in progress, use the show pppoe interface lockout-time command.

PPPoE client (access loop) for PPPoE sessions that contain the IWF-Session DSL

Forum VSA (26-154).

host1# show pppoe interface atm 12/1/1.1.1 lockout-time

PPPoE interface atm 12/1/1.1

Lockout Configuration (seconds): Min 90, Max 120

Total clients in active lockout: 1

Total clients in lockout grace period: 0

Client Address Current Elapsed Next

-------------- ------- ------- ----

0090.1a42.527c 120 30 120

0090.1a42.527c 0 0 90

• To display the source MAC address when a subscriber is connected to the router through an available PPPoE session, use either the show pppoe interface lockout-time command or the show pppoe subinterface full command. (The following example shows only the portion of the command display relevant to the source MAC address.) host1# show pppoe subinterface full

...

PPPoE subinterface ATM 3/0.101 has source MAC address 0090.1a10.165e

...

For a description of the fields in the command display, see “show pppoe interface

lockout-time” on page 603 and “show pppoe subinterface” on page 604.

Chapter 17: Configuring Dynamic Interfaces

Clear the current lockout condition for the PPPoE client associated with the specified source MAC address on the static PPPoE major interface.

host1#pppoe clear lockout interface atm 3/0.101 0090.1a10.165e

If the specified PPPoE client is undergoing active lockout or is in a lockout grace period, issuing the pppoe clear lockout interface command causes the router to reset the current lockout condition and start the next lockout interval at the minimum configured lockout time.

The lockout grace period occurs when the time between lockout events is greater than either 15 minutes or the maximum lockout time. When a PPPoE client is in a lockout grace period, the router resets the number of consecutive lockout events to

1. (For more information, see “Guidelines for Configuring Encapsulation Type Lockout for PPPoE sessions” on page 523.)

pppoe clear lockout interface

•

Use to clear the lockout condition for the PPPoE client associated with the specified source MAC address.

•

For PPPoE clients undergoing active lockout or in a lockout grace period, issuing the pppoe clear lockout interface command causes the router to reset the current lockout condition and start the next lockout interval at the minimum configured lockout time.

•

For PPPoE sessions that contain the IWF-Session DSL Forum VSA (26-254) in the

PPPoE active discovery request (PADR) packets, the encapsulation lockout condition is cleared for all IWF PPPoE sessions whose source MAC address matches the MAC address specified in the command. In lower-numbered releases, issuing this command cleared the lockout condition only for one PPPoE session associated with a specific

MAC address.

•

You must specify the following:

•

interfaceType—One of the following interface types listed in Interface Types and

Specifiers in JunosE Command Reference Guide:

• atm

• fastEthernet

• gigabitEthernet

• lag

• tenGigabitEthernet

•

interfaceSpecifier—Particular interface; format varies according to interface type; see Interface Types and Specifiers in JunosE Command Reference Guide for information

•

macAddress—Source MAC address of the PPPoE client, specified as a dotted triple of four-digit hexadecimal numbers

•

Example host1#pppoe clear lockout interface gigabitEthernet 2/1.1 1011.22c2.333d

549

JunosE 11.3.x Link Layer Configuration Guide

•

There is no no version.

•

See pppoe clear lockout interface.

Configuring IPoA Dynamic Interfaces

E Series routers support dynamic IP over ATM (IPoA) interfaces. An IPoA interface is IP

over ATM 1483 over ATM AAL5 over ATM. See Figure 46 on page 518.

An IPoA configuration is typically used as a high-speed access service or uplink to another router. A common use is to provision IP over ATM circuits over DSL to connect businesses to the Internet—a B-RAS alternative to circuit aggregation. All provisioning can be through the RADIUS server to minimize any configuration of the router.

When IP packets are received over ATM circuits, the IP interfaces are dynamically constructed over the corresponding ATM 1483 interfaces from the configuration data received from the RADIUS server, a profile, or both.

Figure 54 on page 550 shows the protocol layers that represent the IPoA interface columns,

and the layers within the interface columns that are static and dynamic.

Figure 54: Dynamic IPoA over Static ATM 1483 Interface Columns

When you configure dynamic IPoA interfaces, you must assign a profile. Optionally, you can also assign a subscriber identification.

Configuring a Dynamic IPoA Interface

To configure dynamic IPoA interfaces:

Configure a physical interface.

host1(config)#interface atm 5/0

Configure an ATM subinterface.

host1(config-if)#interface atm 5/0.1

Configure a PVC by specifying the VCD, the VPI, the VCI, and the encapsulation type.

If you want the router to autodetect the encapsulation type, use the aal5autoconfig option.

Chapter 17: Configuring Dynamic Interfaces

atm pvc auto-configure

host1(config-subif)#atm pvc 10 100 22 aal5snap host1(config-subif)#atm pvc 10 100 22 aal5autoconfig

Assign a profile.

host1(config-subif)#profile ip foo

(Optional) Assign subscriber identification.

host1(config-subif)#subscriber ip user charlie domain myispname password lucy

Do either of the following:

•

Configure the subinterface to detect and accept the dynamic IP encapsulation type using the default lockout time range, 1–300 seconds.

host1(config-subif)#auto-configure ip

•

Configure the subinterface to detect and accept the dynamic IP encapsulation type using a nondefault lockout time range. For example, the following command configures 3600 seconds (1 hour) as the minimum lockout time and 7200 seconds

(2 hours) as the maximum lockout time.

host1(config-subif)#auto-configure ip lockout-time 3600 7200

(Optional) Verify your configuration.

host1#show atm subinterface atm 5/0.1

•

Use to configure a PVC on an ATM interface. Specify one of the following encapsulation types:

• aal5autoconfig—Enables autodetection of the 1483 encapsulation (LLC/SNAP or

VC multiplexed).

• aal5snap—Specifies an LLC encapsulated circuit; LLC/SNAP header precedes the protocol datagram.

• aal5mux ip—Specifies a VC multiplexed circuit. This option is used for IP only.

•

Example host1(config-subif)#atm pvc 6 0 11 aal5autoconfig

•

Use the no version to remove the specified PVC.

•

See atm pvc.

•

Use to configure an ATM subinterface to support a dynamic interface. Specifies the types of dynamic encapsulation that the ATM 1483 subinterface detects and accepts.

•

For detailed information about how to use this command, see “auto-configure” on page 528.

•

Example 1—Enables autodetection for the IP encapsulation type using the default lockout time range, 1–300 seconds host1(config-subif)#auto-configure ip

551

JunosE 11.3.x Link Layer Configuration Guide

interface atm profile

•

Example 2—Enables autodetection for the IP encapsulation type using a nondefault lockout time range, 3600–21600 seconds (1–6 hours) host1(config-subif)#auto-configure ip lockout-time 3600 21600

•

Example 3—Disables encapsulation type lockout for the IP encapsulation type host1(config-subif)#auto-configure ip lockout-time none

•

Example 4—Either command reenables encapsulation type lockout for the IP encapsulation type using the default lockout time range host1(config-subif)#auto-configure ip host1(config-subif)#no auto-configure ip lockout-time

•

Example 5—Permanently locks out the IP encapsulation type until the auto-configure ip command is issued host1(config-subif)#no auto-configure ip

•

Use the no version to terminate detection of the specified encapsulation type or, if the lockout-time keyword is specified, to restore the lockout time range to its default value,

1–300 seconds.

•

See auto-configure.

•

Use to select an ATM interface or ATM 1483 subinterface.

•

For information about specifying the ATM interface or subinterface, see “interface atm” on page 529.

•

Examples host1(config)#interface atm 5/0.1

host1(config)#interface atm 4/0/2.1

•

Use the no version to remove the interface or subinterface.

•

See interface atm.

•

Use to assign a profile.

•

You must specify the encapsulation type to which the profile applies: bridgedEthernet, ip, ppp, pppoe , or any.

•

Specify a profile name with up to 80 alphanumeric characters.

•

Example host1(config-subif)#profile ppp foo

•

Use theno version to remove a profile assignment.

•

See profile.

subscriber

Chapter 17: Configuring Dynamic Interfaces

•

Use to configure a local subscriber on the E Series router to support authentication and configuration from RADIUS for a dynamic IPoA or bridged Ethernet interface.

•

When you configure a subscriber, you must specify the following:

•

interfaceType—Type of dynamic interface, bridgedEthernet or ip

•

userNameUsage—How the dynamic interface uses the username for authentication purposes

• user—Use the name as specified.

• user-prefix—Use the name as a prefix to the interface physical location. The router automatically postpends the physical location of the user to the username string.

The username format is userName.slot.port.vpi.vci. The resulting username string is then used to authenticate with the RADIUS server.

•

userName—RADIUS username

•

domainName—Domain name

•

You may optionally supply password information:

•

passwordUsage—How the dynamic interface uses the password for authentication purposes

• password—Use the password as specified.

• password-prefix—Use the password as a prefix to the interface physical location.

The router automatically postpends the physical location of the user to the password string. The password format is password.slot.port.vpi.vci. The resulting password string is then used to authenticate with the RADIUS server.

•

password—RADIUS password

•

If your router is running stateful SRP switchover (high availability), the use of the subscriber command to configure RADIUS authentication for subscribers on dynamic bridged Ethernet interfaces might suspend stateful SRP switchover on the router or prevent stateful SRP switchover from becoming active. For more information about using the subscriber management application to bypass this limitation, see

“Authenticating Subscribers on Dynamic Bridged Ethernet over Static ATM Interfaces” on page 519.

•

Example 1 host1(config-subif)#subscriber ip user-prefix charlie domain myisp password-prefix lucy

•

Example 2 host1(config-subif)#subscriber bridgedEthernet user westford003 domain acmecorp.east password xyz123

•

Use the no version to remove the subscriber.

•

See subscriber.

553

JunosE 11.3.x Link Layer Configuration Guide

Configuring Bridged Ethernet Dynamic Interfaces

A bridged Ethernet interface is IP over bridged Ethernet over ATM 1483 over ATM AAL5 over ATM.

When bridged Ethernet packets are received over ATM circuits, the bridged Ethernet and

IP interfaces are dynamically constructed over the corresponding ATM 1483 interfaces and use the configuration data received from the RADIUS server, a profile, or both.

Figure 55 on page 554 shows the protocol layers that represent the bridged Ethernet

interface columns, and the layers within the interface columns that are static and dynamic.

Figure 55: Dynamic Bridged Ethernet over Static ATM 1483 Interface

Columns

Configuring a Dynamic Bridged Ethernet Interface

When you configure dynamic bridged Ethernet interfaces, you must assign a profile. You may optionally assign a subscriber identification.

To configure dynamic bridged Ethernet interfaces:

Configure a physical interface.

host1(config)#interface atm 5/0

Configure an ATM subinterface.

host1(config-if)#interface atm 2/0.1

Configure a PVC by specifying the VCD, the VPI, the VCI, and the encapsulation type.

If you want the router to autodetect the encapsulation type, use the aal5autoconfig option.

host1(config-subif)#atm pvc 10 100 22 aal5snap host1(config-subif)#atm pvc 10 100 22 aal5autoconfig

Do either of the following:

Chapter 17: Configuring Dynamic Interfaces

atm pvc auto-configure

•

Configure the subinterface to detect and accept the dynamic bridged Ethernet encapsulation type with the default lockout time range, 1–300 seconds.

host1(config-subif)#auto-configure bridgedEthernet

•

Configure the subinterface to detect and accept the dynamic bridged Ethernet encapsulation type with a nondefault lockout time range. For example, the following command configures 3600 seconds (1 hour) as the minimum lockout time and

7200 seconds (2 hours) as the maximum lockout time.

host1(config-subif)#auto-configure bridgedEthernet lockout-time 3600 7200

Assign a profile to match the encapsulation type of bridged Ethernet.

host1(config-subif)#profile bridgedEthernet foo

(Optional) Assign subscriber identification.

host1(config-subif)#subscriber bridgedEthernet user charlie domain myisp password lucy

(Optional) Verify your configuration.

host1#show atm subinterface atm 2/0.1

•

Use to configure a PVC on an ATM interface. Select one of the following encapsulation types:

• aal5autoconfig—Enables autodetection of the 1483 encapsulation (LLC/SNAP or

VC multiplexed).

• aal5snap—Specifies a LLC encapsulated circuit; the LLC/SNAP header precedes the protocol datagram.

• aal5mux ip—Specifies a VC multiplexed circuit. This option is used for IP only.

•

Example host1(config-subif)#atm pvc 6 0 11 aal5autoconfig

•

Use the no version to remove the specified PVC.

•

See atm pvc.

•

Use to configure an ATM subinterface to support a dynamic interface. Specifies the types of dynamic encapsulation that the ATM 1483 subinterface detects and accepts.

•

For detailed information about how to use this command, see “auto-configure” on page 528.

•

Example 1—Enables autodetection for the bridged Ethernet encapsulation type using the default lockout time range, 1–300 seconds host1(config-subif)#auto-configure bridgedEthernet

•

Example 2—Enables autodetection for the bridged Ethernet encapsulation type using a nondefault lockout time range of 3600–21600 seconds (1–6 hours)

555

JunosE 11.3.x Link Layer Configuration Guide

interface atm profile

host1(config-subif)#auto-configure bridgedEthernet lockout-time 3600 21600

•

Example 3—Disables encapsulation type lockout for the bridged Ethernet encapsulation type host1(config-subif)#auto-configure bridgedEthernet lockout-time none

•

Example 4—Either command reenables encapsulation type lockout for the bridged

Ethernet encapsulation type using the default lockout time range host1(config-subif)#auto-configure bridgedEthernet host1(config-subif)#no auto-configure bridgedEthernet lockout-time

•

Example 5—Permanently locks out the bridged Ethernet encapsulation type until the auto-configure bridgedEthernet command is issued host1(config-subif)#no auto-configure bridgedEthernet

•

Use the no version to terminate detection of the specified encapsulation type or, if the lockout-time keyword is specified, to restore the lockout time range to its default value,

1–300 seconds.

•

See auto-configure.

•

Use to select an ATM interface or ATM 1483 subinterface.

•

For information about specifying the ATM interface or subinterface, see “interface atm” on page 529.

•

Examples host1(config)#interface atm 5/0.1

host1(config)#interface atm 4/0/2

•

Use the no version to remove the interface or subinterface.

•

See interface atm.

•

Use to assign a profile.

•

You must specify the encapsulation type to which the profile applies: bridgedEthernet, ip, ppp, pppoe , or any.

•

Specify a profile name with up to 80 alphanumeric characters.

•

Example host1(config-subif)#profile bridgedEthernet foo

•

Use the no version to remove a profile assignment.

•

See profile.

subscriber

Chapter 17: Configuring Dynamic Interfaces

•

Use to configure a local subscriber on the E Series router to support authentication and configuration from RADIUS for a dynamic bridged Ethernet or IPoA interface.

•

For detailed information about how to use this command, see “subscriber” on page 553.

•

Example host1(config-subif)#subscriber bridgedEthernet user-prefix charlie domain myisp password-prefix lucy

•

Use the no version to remove the subscriber.

•

See subscriber.

Configuring Subscriber Management for IP Subscribers on Dynamic Bridged Ethernet Interfaces

You can use the JunosE subscriber management application to configure and manage

IP subscribers associated with a dynamic bridged Ethernet over static ATM 1483 interface

column, as described in “Authenticating Subscribers on Dynamic Bridged Ethernet over

Static ATM Interfaces” on page 519.

To use the subscriber management application to configure IP subscribers on a dynamic bridged Ethernet interface for RADIUS authentication:

Define an IP service profile that contains the subscriber’s RADIUS authentication parameters including the username, domain, and password.

Configure the interface profile from which the router creates a dynamic bridged

Ethernet interface column.

a. Include the desired characteristics for the upper-layer encapsulation types.

b. (Optional) Specify the name of the route map used to configure the IP subscriber interface.

c. Use the bridge1483 service-profile command to assign the specified IP service profile to the interface profile. The IP service profile contains the RADIUS authentication parameters for subscribers on the dynamic bridged Ethernet interface.

Define the underlying static or dynamic ATM 1483 subinterface on which the dynamic bridged Ethernet interface column is built.

a. Assign the specified interface profile to the ATM 1483 subinterface.

b. Enable autodetection (autoconfiguration) of the bridged Ethernet upper-layer encapsulation type.

c. Define the ATM PVC over which data is transmitted.

(Optional) Use the show profile command to verify assignment of the IP service profile to the interface profile.

For information, see “show profile” on page 604.

557

JunosE 11.3.x Link Layer Configuration Guide

558

Configuration Example Using subscriber Command

The following configuration example illustrates the preceding procedure. The example has two parts:

•

The first part of the example shows how to use the subscriber command to configure

RADIUS authentication for IP subscribers on a dynamic bridged Ethernet interface.

This configuration method does not support running stateful SRP switchover on the router.

•

The second part of the example shows the commands required to re-create this configuration using the IP subscriber management application. This configuration method uses the bridge1483 service-profile command to assign the specified IP service profile to the interface profile, and does support running stateful SRP switchover on the router.

Assume that you have issued the following commands to configure IP subscribers on a dynamic bridged Ethernet interface for RADIUS authentication. In this configuration, the subscriber command provides the subscriber’s authentication parameters, and the static

ATM 1483 subinterface is the authenticating layer. Keep in mind that the subscriber command does not support running stateful SRP switchover on the router.

! Configure the interface profile from which to create a dynamic bridged Ethernet

! interface. Include the desired attributes (in this case, IGMP) and, optionally, the

! name of the route map used to configure the IP subscriber interface.

host1(config)#profile east host1(config-profile)#ip igmp host1(config-profile)#ip igmp immediate-leave host1(config-profile)#ip igmp group limit 6 host1(config-profile)#ip route-map ip-subscriber eastRouteMap host1(config-profile)#exit

! Configure the static ATM 1483 subinterface to assign the east profile, support

! RADIUS authentication, enable autodetection of the bridged Ethernet upper-layer

! encapsulation type, and define the ATM PVC.

host1(config)#interface atm 2/1.100 point-to-point host1(config-subif)#profile bridgedEthernet east host1(config-subif)#subscriber bridgedEthernet user westford001 domain xyzcorp.east password abc123 host1(config-subif)#auto-configure bridgedEthernet host1(config-subif)#atm pvc 100 10 101 aal5snap 6400 0 0 host1(config-subif)#exit

Equivalent Configuration Example Using IP Subscriber Management

To achieve the same functionality without adversely affecting stateful SRP switchover if it is running on the router, you can issue the following commands to use the subscriber management feature to configure IP subscribers on a dynamic bridged Ethernet interface using RADIUS. In this configuration, the IP service profile provides the subscriber’s authentication parameters, and the subscriber management application is the authenticating layer. To assign the IP service profile to the interface profile, use the bridge1483 service-profile command.

! Define an IP service profile containing the subscriber’s username, domain, and password.

Chapter 17: Configuring Dynamic Interfaces host1(config)#ip service-profile eastServiceProfile host1(config-service-profile)#user-name westford001 host1(config-service-profile)#domain xyzcorp.east

host1(config-service-profile)#password abc123 host1(config-service-profile)#exit

! Configure the interface profile from which to create a dynamic bridged Ethernet

! interface. Include the desired attributes (in this case, IGMP), the name of the

! route map used to configure the IP subscriber interface (optional), and the name

! of the IP service profile containing the authentication parameters for the dynamic

! bridged Ethernet interface.

! Configure the static ATM 1483 subinterface to assign the east profile,

! enable autodetection of the bridged Ethernet upper-layer encapsulation type,

! and define the ATM PVC.

host1(config)#interface atm 2/1.100 point-to-point host1(config-subif)#profile bridgedEthernet east host1(config-subif)#auto-configure bridgedEthernet host1(config-subif)#atm pvc 100 10 101 aal5snap 6400 0 0 host1(config-subif)#exit

For more information about using the subscriber management application, see JunosE

Broadband Access Configuration Guide.

bridge1483 service-profile

•

Use from Profile Configuration mode to assign the specified IP service profile to the interface profile from which a dynamic bridged Ethernet interface is created.

•

The IP service profile must be defined in the default virtual router.

•

Example host1(config-profile)#bridge1483 service-profile westServiceProfile

•

Use the no version to remove the IP service profile assignment from the interface profile.

•

See bridge1483 service-profile.

Configuring a Dynamic Interface from a Profile

You define profiles by using CLI commands similar to the ones you use to configure static interfaces. When configuring profiles, you can specify every layer explicitly or specify a subset of layers.

Profile Considerations

When a dynamic interface is configured, the configuration data received from the RADIUS authentication server typically overrides configuration data obtained from a profile.

559

JunosE 11.3.x Link Layer Configuration Guide

PPP, PPP, and PPPoE interfaces. The auto-configure command identifies the encapsulation type. For flexibility, the router provides the ability to configure an ATM

1483 subinterface with distinct profile assignments for each encapsulation type supported by the auto-configure command.

In contrast to dynamic ATM 1483 subinterfaces, dynamic VLAN subinterfaces support recognition and creation of simultaneous IP and PPPoE upper dynamic interface types.

The vlan auto-configure command identifies the encapsulation type. For flexibility, the router provides the ability to configure a VLAN subinterface with distinct profile assignments for each encapsulation type supported by the vlan auto-configure command.

Each profile typically contains configuration attributes for the expected encapsulation, in addition to attributes for other higher-interface layers through IP. If your configuration of upper layers is intended to be different depending on which incoming encapsulation is received by the subinterface, configure and assign separate profiles for each encapsulation type. If your configuration of upper layers is the same for more than one encapsulation type, configure one profile and assign it for those encapsulation types.

Profile Characteristics

Currently, profiles support bridged Ethernet, IP, IPv6, L2TP, Multilink PPP, PPP, PPPoE, and VLANs. You create a profile with a specific set of characteristics. You then assign the profile to multiple interfaces instead of creating separate interfaces with identical attributes. After you create a profile, you can assign it to static ATM 1483, static PPP, or static VLAN major interfaces on different devices.

Bridged Ethernet Characteristics

A profile can contain the following bridged Ethernet characteristic:

• mtu—Sets the maximum allowable size, in bytes, of the maximum transmission unit

(MTU) for dynamic bridged Ethernet interfaces

IP Characteristics

A profile can contain one or more of the following IP characteristics:

• access-routes—Enables the creation of host access routes on an interface

• address—Configures an IP address on an interface

• auto-configure ip-subscriber—Configures a primary IP interface to enable dynamic creation of subscriber interfaces

• auto-detect ip-subscriber—Enables packet detection on the router and specifies that

IP automatically detects packets that do not match any entries in the demultiplexer table

• directed-broadcast—Enables directed broadcast forwarding

• filter-options all—Filters out packets that include IP options

Chapter 17: Configuring Dynamic Interfaces

• igmp—Configures an IGMP interface

• ignore-df-bit—Specifies that the don’t-fragment bit is ignored

• inactivity-timer—Configures an inactivity timer value for IP interfaces

• inspection—Associates an inspection list to the interface for firewalling

• mtu—Configures the MTU for a network

• nat—Configures the interface as inside or outside for Network Address Translation

(NAT)

• policy—Assigns a policy to the ingress or egress of an interface

• redirects—Enables transmission of ICMP redirect messages

• route-cache flow sampled—Enables J-Flow statistics on an interface

• route-map ip-subscriber—Configures the interface for route-map processing

• sa-validate—Verifies that a packet has been sent from a valid source address

• tcp adjust-mss—Modifies maximum segment size (MSS) on TCP connections when path MTU detection is not sufficient

• unnumbered—Configures IP on this interface without a specific address

• virtual-router—Specifies a virtual router (VR) to which interfaces created by this profile attach

IPv6 Characteristics

A profile can contain one or more of the following IPv6 characteristics:

• address—Configures an IPv6 address on an interface

• http—Configures the HTTP local server for IPv6

• http redirectUrl—Configures the URL to which a subscriber’s initial Web browser session is redirected

• nd—Enables Neighbor Discovery on an interface

• nd managed-config-flag—Sets the “managed address configuration” flag in IPv6 router advertisements

• nd other-config-flag—Sets the “other stateful configuration” flag in IPv6 router advertisements

• nd prefix-advertisement—Specifies which IPv6 prefixes are included in IPv6 router advertisements

• nd ra-interval—Configures the interval between IPv6 router advertisements

• nd ra-lifetime—Configures the router advertisement lifetime

• nd reachable-time—Configures the amount of time the router can reach an IPv6 node after a reachability confirmation event occurs

• nd suppress-ra—Disables router advertisement transmissions

561

JunosE 11.3.x Link Layer Configuration Guide

562

• mld—Configures the multicast listener discovery (MLD) interface

• mtu—Configures the MTU for a network

• policy—Attaches (or removes) a policy to (or from) an interface

• sa-validate—Enables source address validation

• unnumbered—Configures IPv6 on this interface without a specific address

• virtual-router—Specifies a virtual router to which interfaces created by this profile attach

L2TP Characteristics

A profile can contain the following L2TP characteristic:

• policy—Assigns an L2TP policy list to a profile

MLPPP and PPP Characteristics

A profile can contain one or more of the following MLPPP or PPP characteristics:

• aaa-profile—Assigns an AAA profile

• authentication—Requests PAP or CHAP authentication from a PPP peer

• authentication virtual router—Specifies a virtual router for the authentication virtual router context

• chap challenge length—Modifies the length of the CHAP challenge

• fragmentation—Enables fragmentation on an MLPPP link interface

• hash-link-selection—Enables use of a hash-based algorithm to select the link on which the router transmits non-best-effort (high-priority) packets, such as voice or video, on dynamic MLPPP interfaces

• initiate-ip—Initiates IPv4 for passive clients

• initiate-ipv6—Initiates IPv6 for passive clients

• ipcp lockout—Terminates an invalid subscriber entry and prevents additional IPCP negotiations

• ipcp netmask—Controls the negotiation of the IPCP netmask option 0x90; disabled indicates do not negotiate, enabled indicates negotiate

• keepalive—Specifies a keepalive value, in seconds

• log—Enables packet or state machine logging for any dynamic interfaces that use the profile

• magic-number disable—Disables negotiation of the local magic number

• magic-number ignore-mismatch—Causes the router to ignore a mismatch of the LCP peer magic number and retain the PPP connection when the peer has not negotiated an LCP magic number.

• max-negotiations—Configures the maximum number of LCP, IPCP, or IPv6CP renegotiation attempts that the router accepts before terminating a PPP session

Chapter 17: Configuring Dynamic Interfaces

• mru—Configures the maximum receive unit size for the interface

• multilink enable—For MLPPP interfaces only, enables the creation of dynamic MLPPP interfaces

• multilink multiclass—Enables the creation of multilink classes on a multiclass MLPPP interface

• multilink multiclass fragmentation—Enables fragmentation on a multiclass MLPPP interface

• multilink multiclass reassembly—Enables reassembly on a multiclass MLPPP interface

• multilink multiclass traffic-class—Configures mapping of QoS traffic classes to multilink classes on a multiclass MLPPP interface

• passive-mode—Forces the interface into passive mode before LCP negotiation begins, for a period of one second to enable slow clients to start up and initiate the LCP negotiation

• peer dns—Resolves conflicts when the E Series router and the PPP peer system have the primary and secondary DNS addresses configured with different values

• peer wins—Resolves conflicts when the E Series router and the PPP peer system have the primary and secondary WINS addresses configured with different values

• reassembly—Enables reassembly on an MLPPP link interface

PPPoE Characteristics

A profile can contain one or more of the following PPPoE characteristics:

• AC name—Adds an access concentrator name to the profile configuration

• always-offer—Causes the router to offer to set up a session for the client, even when the router has insufficient resources to establish a session

• duplicate-protection—Prevents a client from establishing more than one session using the same MAC address

NOTE: When the duplicate protection feature is enabled for PPPoE sessions that contain the IWF-Session DSL VSA (26–254) in the PPoE Active

Discovery Request (PADR) packet sent from PPPoE clients to the access concentrator, multiple IWF PPPoE sessions that contain the same MAC address are still processed and can access network services until the maximum number of PPPoE sessions configured per major interface

(configured using the pppoe sessions command) is reached.

• log pppoeControlPacket—Enables packet trace logging on PPPoE dynamic interfaces created with this profile

• motm—Causes the router to send a PPPoE Active Discovery Message (PADM) message of the minute

• mtu—Configures the MTU

563

JunosE 11.3.x Link Layer Configuration Guide

• remote-circuit-id—Enables the router to capture and process a vendor-specific tag containing a remote circuit ID transmitted from a digital subscriber line access multiplexer (DSLAM) device

• service-name-table—Assigns a PPPoE service name table to dynamic interfaces created with this profile

• sessions—Specifies the maximum number of subinterfaces permitted on a PPPoE major interface

• url—Causes the PPPoE application to send a URL string to the new client

VLAN Characteristics

A profile can contain one or more of the following VLAN characteristics:

• advisory-rx-speed—Sets an advisory receive speed for VLAN subinterfaces

• advisory-tx-speed—Sets an advisory connect speed for VLAN subinterfaces

• auto-configure—Specifies the types of upper-interface encapsulations that are accepted or detected by the dynamic VLAN subinterface

• auto-configure agent-circuit-identifier—Enables the creation of VLAN subinterfaces that are based on agent-circuit-identifier information

• description—Assigns a description to VLAN subinterfaces that are created with this profile

• policy—Attaches (or removes) a policy to (or from) a dynamically created VLAN

• profile—Adds a nested profile assignment, which references another profile that dynamically configures an upper-interface encapsulation type over the VLAN subinterface

• service-profile—Specifies a service profile name to a dynamically created VLAN

• svlan ethertype—Specifies that the packet must use this Ethertype to create the dynamic VLAN subinterface

Working with Profiles

Figure 56 on page 564 shows how to create a profile and assign characteristics to it.

Figure 56: Creating and Configuring a Profile

Figure 57 on page 565 shows how to assign a profile to static interfaces. These static

interfaces create dynamic interfaces above them.

Figure 57: Assigning a Profile to a Static Interface

Chapter 17: Configuring Dynamic Interfaces

Configuring a Profile

You can create a profile by using CLI commands similar to those used to create the equivalent static interfaces. You can configure a profile for bridged Ethernet, IP, IPv6,

MLPPP, PPP, PPPoE, or VLAN interfaces.

To configure a profile:

Create a profile by assigning it a name.

host1(config)#profile foo

Specify a VR to which to assign dynamic IP interfaces created with this profile.

host1(config-profile)#ip virtual-router egypt

Specify an IP loopback interface for dynamic IP interfaces created with this profile to be associated.

host1(config-profile)#ip unnumbered loopback 0

Configure IPCP option 0x90.

host1(config-profile)#ppp ipcp netmask

Optionally set IP, IPv6, MLPPP, PPP, or PPPoE characteristics.

NOTE: When configuring either IP or IPv6 to operate over PPP, you might want to initiate IP or IPv6 by using the appropriate ppp initiate command, either ppp initiate-ip or ppp initiate-ipv6. This command initiates either

IPv4 or IPv6 in the event you are connecting to a passive client.

bridge1483 mtu

•

Use to set the maximum allowable size, in bytes, of the MTU for bridged Ethernet interfaces.

•

Specify an MTU size in the range 64–9180 bytes.

565

JunosE 11.3.x Link Layer Configuration Guide

•

Example host1(config-profile)#bridge1483 mtu 1684

•

Use the no version to restore the default MTU size for bridged Ethernet interfaces, 1518 bytes.

•

See bridge1483 mtu.

ip access-routes

•

Use to enable an access route in a profile.

•

Example host1(config-profile)#ip access-routes

•

Use the no version to remove the access route.

•

See ip access-routes.

ip address

•

Use to assign an IP address to a profile.

•

Example host1(config-profile)#ip address 192.13.5.61

•

Use the no version to remove the IP address assignment from the profile.

•

See ip address.

ip auto-configure ip-subscriber

•

Use to configure a primary IP interface to enable dynamic creation of subscriber interfaces.

•

Use the include-primary keyword to specify that the primary interface is assigned to the first subscriber.

•

Use the exclude-primary keyword to specify that the primary interface is not used for dynamic subscribers. By default, the primary interface is not assigned to a dynamic subscriber.

•

Example host1(config-profile)#ip auto-configure ip-subscriber include-primary

•

Use the no version to disable creation of dynamic subscriber interfaces associated with this primary IP interface. Use the no version with the include-primary keyword to specify that the primary interface is not assigned to a subscriber. Use the no version with the exclude-primary keyword to specify that the primary interface is assigned to a subscriber.

•

See ip auto-configure ip-subscriber.

ip auto-detect ip-subscriber

Chapter 17: Configuring Dynamic Interfaces

•

Use to enable packet detection on the router and specify that IP automatically detect packets that do not match any entries in the demultiplexer table.

•

Example host1(config-profile)#ip auto-detect ip-subscriber

•

Use the no version to restore the default behavior, which disables packet detection.

•

See ip auto-detect ip-subscriber.

ip directed-broadcast

•

Use to enable a directed broadcast address in a profile.

•

Example host1(config-profile)#ip directed-broadcast

•

Use the no version to remove the directed broadcast address from the profile.

•

See ip directed-broadcast.

ip filter-options all

•

Use to filter out packets that include IP options.

•

Example host1(config-profile)#ip filter-options all

•

Use the no version to disable filtering of packets with IP options.

•

See ip filter-options all.

ip igmp

•

Use to enable IGMP on an interface, and sets the IGMP version to IGMPv2.

•

Example host1(config-profile)#ip igmp

•

Use the no version to disable IGMP on an interface.

•

See ip igmp.

ip ignore-df-bit

•

Use to force the router to ignore the DF bit if it is set in the IP packet header for packets on an interface.

•

Example

NOTE: You can also use RADIUS VSA [26-70] to configure the router’s DF bit support. The action configured by the RADIUS VSA takes precedence over the action configured by the ip ignore-df-bit command. For more information, see JunosE Broadband Access Configuration Guide.

567

JunosE 11.3.x Link Layer Configuration Guide

ip inactivity-timer ip inspection ip mtu ip nat

host1(config-profile)#ip ignore-df-bit

•

Use the no version to restore the default behavior, which is to consider the DF bit before fragmentation.

•

See ip ignore-df-bit.

•

Use to configure an inactivity timer value for an IP interface. IP polls the dynamic interface at the configured interval to determine whether the interface was active during the interval. Inactive interfaces are deleted only when the period of inactivity is equal to or greater than the configured value.

For example, if you configure an inactivity timer of 15 minutes, IP polls the interface every 15 minutes. If a poll determines that the interface was last active 14 minutes earlier, the inactive time is less than the configured value so nothing happens. IP polls again 15 minutes later. If the interface is still inactive then the total period of inactivity is now 29 minutes. This is greater than the configured value and the interface is deleted.

•

Example host1(config-profile)#ip inactivity-timer 100

•

Use the no version to restore the default behavior, which disables the inactivity timer.

•

See ip inactivity-timer.

•

Use to associate an inspection list to the inbound or outbound side of the IP interface.

•

Example host1(config-profile)#ip inspection list1

•

Use the no version to remove the inspection list association to this interface.

•

Use to assign the maximum transmission unit size sent on an IP interface.

•

Example host1(config-profile)#ip mtu 1000

•

Use the no version to restore the default value, 0, which means that the router takes the value from a lower protocol layer.

•

See ip mtu.

•

Use to mark interfaces that participate in NAT translation as residing on the inside or the outside network.

•

Example host1(config-profile)#ip nat inside

Chapter 17: Configuring Dynamic Interfaces

•

Use the no version to unmark the interface (the default) so that it does not participate in NAT translation.

•

See ip nat.

ip policy

•

Use to assign a policy list to the ingress or egress of an interface to which the profile is attached.

•

Example host1(config-profile)#ip policy secondary-input my-policy

•

Use the no version to remove the association between a policy list and a profile.

•

See ip policy.

ip redirects

•

Use to enable the sending of redirect messages if the software is forced to resend a packet through the same interface on which it was received.

•

Example host1(config-profile)#ip redirects

•

Use the no version to remove the assignment from the profile.

•

See ip redirects.

ip route-cache flow sampled

•

Use to enable J-Flow statistics on the interface.

•

Example host1(config-profile)#ip route-cache flow sampled

•

Use the no version to delete J-Flow statistics from the profile.

•

See ip route-cache flow sampled.

ip route-map ip-subscriber

•

Use to configure an interface for route-map processing and specify the route map that is applied to the IP interface subscriber.

•

Example host1(config-profile)#ip route-map ip-subscriber chicagoRouteMap

•

Use the no version to delete the route map.

•

See ip route-map ip-subscriber.

ip sa-validate

•

Use to enable source address validation on an IP interface.

•

Source address validation verifies that a packet has been sent from a valid source address.

569

JunosE 11.3.x Link Layer Configuration Guide

ip tcp adjust-mss ip unnumbered ip virtual-router ipv6 address

•

Example host1(config-profile)#ip sa-validate

•

Use the no version to disable source address validation.

•

See ip sa-validate.

•

Use to modify the maximum segment size (MSS) for TCP SYN packets traveling through the interface.

•

Example host1(config-profile)#ip tcp adjust-mss 200

•

Use the no version to remove the MSS modification.

•

See ip tcp adjust-mss.

•

Use to specify the unnumbered interface with which dynamic interfaces created with the profile are associated.

•

You can configure a loopback using RADIUS instead of adding one to the profile using the ip unnumbered loopback command.

•

Example host1(config-profile)#ip unnumbered loopback 5

•

Use the no version to remove the assignment from the profile.

•

See ip unnumbered

•

Use to assign a virtual router (VR) to a profile. Interfaces created by the profile are attached to this VR.

•

If the VR specified in a profile with the ip virtual-router command differs from the VR provided by AAA, IP uses the VR provided by AAA when the dynamic IP upper-layer interface is created. For more information about using the ppp authentication

virtual-router command, see “ppp authentication” on page 575.

•

Example host1(config-profile)#ip virtual-router salem1

•

Use the no version to remove the VR assignment from the profile. If no VR is specified via RADIUS, then any subsequent use of the profile to create a dynamic interface fails for lack of a VR.

•

See ip virtual-router

•

Use to configure an IPv6 address on an interface to which the profile is attached.

•

Example

Chapter 17: Configuring Dynamic Interfaces

ipv6 http ipv6 http redirectUrl

host1(config-profile)#ipv6 address 1::1/64

•

Use the no version to remove the IPv6 address from the interface.

•

See ipv6 address.

•

Use to create the HTTP local server to listen and process for IPv6 exception packets.

•

See Configuring the HTTP Server to Support Guided Entrance in the JunosE Broadband

Access Configuration Guide

•

Example host1(config)#ipv6 http

•

Use the no version to delete the HTTP local server.

•

See ipv6 http.

•

Use to specify the URL to which a subscriber’s HTTP access session is redirected.

•

The first access session is typically used by the Service Manager application to provide initial provisioning and service selection for the subscriber.

•

HTTP redirect is per-interface; use the command in Interface, Subinterface or Profile

Configuration mode for static interfaces.

•

The redirect URL can be a maximum of 64 characters.

ipv6 mld

NOTE: The HTTP local server must be configured and enabled in the virtual router for the interface on which you use the ipv6 http redirectUrl command.

Otherwise, the URL redirect operation will fail.

•

See Configuring the HTTP Server to Support Guided Entrance in the JunosE Broadband

Access Configuration Guide

•

Example host1(config-if)#ipv6 http redirectUrl http://ispsite.redirect.com

•

Use the no version to restore the default, which disables the HTTP redirect feature.

•

See ipv6 http redirectUrl.

•

Use to enable MLD on an interface, and set the MLD version to MLDv2.

•

Example host1(config-profile)#ipv6 mld

•

Use the no version to disable MLD on an interface.

•

See ipv6 mld.

571

JunosE 11.3.x Link Layer Configuration Guide

ipv6 mtu

•

Use to set the maximum transmission unit size of IPv6 packets sent on an interface.

•

Example host1(config-profile)#ipv6 mtu 1000

•

Use the no version to restore the default value, 0, which means that the router takes the value from a lower protocol layer.

•

See ipv6 mtu.

ipv6 nd

•

Use to enable the IPv6 Neighbor Discovery process on an interface.

•

Example host1(config-profile)#ipv6 nd

•

Use the no version to disable the Neighbor Discovery process.

•

See ipv6 nd.

ipv6 nd managed-config-flag

•

Use to set the “managed address configuration” flag in IPv6 router advertisements.

•

Example host1(config-profile)#ipv6 nd managed-config-flag

•

Use the no version to clear the flag from IPv6 router advertisements.

•

See ipv6 nd managed-config-flag.

ipv6 nd other-config-flag

•

Use to set the “other stateful configuration” flag in IPv6 router advertisements.

•

Example host1(config-profile)#ipv6 nd other-config-flag

•

Use the no version to clear the flag from IPv6 router advertisements.

•

See ipv6 nd other-config-flag.

ipv6 nd prefix-advertisement

•

Use to specify which IPv6 prefixes the system includes in IPv6 router advertisements.

•

Example host1(config-profile)#ipv6 nd prefix-advertisement 2002:1::/64 60000 45000 onlink autoconfig

•

Use the no version to remove any prefixes from the IPv6 routing advertisements.

•

See ipv6 nd prefix-advertisement.

ipv6 nd ra-interval

Chapter 17: Configuring Dynamic Interfaces

•

Use to specify the interval, in seconds, between IPv6 router advertisement retransmissions on an interface.

•

Example host1(config-profile)#ipv6 nd ra-interval 500

•

Use the no version to restore the default interval, 200 seconds.

•

See ipv6 nd ra-interval.

ipv6 nd ra-lifetime

•

Use to specify the router lifetime value, in seconds, in IPv6 router advertisements on an interface. The router lifetime value is the amount of time the router is considered the default router on this interface.

•

Example host1(config-profile)#ipv6 nd ra-lifetime 900

•

Use the no version to restore the default lifetime, 1800 seconds.

•

See ipv6 nd ra-lifetime.

ipv6 nd reachable-time

•

Use to specify the amount of time, in milliseconds, that the E Series router can reach a remote IPv6 node after some reachability confirmation event has occurred.

•

Example—Sets the reachable-time to 30,000 milliseconds host1(config-profile)#ipv6 nd reachable-time 30000

•

Use the no version to restore the default value 0 milliseconds for router advertisements and 3,600,000 milliseconds (1 hour) for Neighbor Discovery activity of the E Series router.

•

See ipv6 nd reachable-time.

ipv6 nd suppress-ra

•

Use to suppress IPv6 router advertisement transmissions on a LAN local area network

(Ethernet) interface.

•

Example host1(config-profile)#ipv6 nd suppress-ra

•

Use the no version to reenable the sending of IPv6 router advertisement transmissions on the LAN (Ethernet) interface

•

See ipv6 nd suppress-ra.

ipv6 policy

•

Use to assign a policy list to the ingress or egress of an interface to which the profile is attached.

•

Example host1(config-profile)#ipv6 policy secondary-input my-policy

573

JunosE 11.3.x Link Layer Configuration Guide

ipv6 sa-validate ipv6 unnumbered ipv6 virtual-router l2tp policy

•

Use the no version to remove the association between a policy list and a profile.

•

See ipv6 policy

•

Use to enable source address validation on an IPv6 interface.

•

Source address validation verifies that a packet has been sent from a valid source address.

•

Example host1(config-profile)#ipv6 sa-validate

•

Use the no version to disable source address validation.

•

See ipv6 sa-validate.

•

Use to enable or disable IPv6 processing on an interface without assigning an explicit

IPv6 address to that interface.

•

Example host1(config-profile)#ipv6 unnumbered loopback 0

•

Use the no version to remove the IPv6 address from the interface.

•

See ipv6 unnumbered.

•

Use to specify a VR in an IPv6 profile. Dynamic interfaces created with the profile are assigned to this VR.

•

Example host1(config-profile)#ipv6 virtual-router westford01

•

Use the no version to remove the VR assignment from the profile. If no VR is specified via RADIUS, then any subsequent use of the profile to create a dynamic interface fails for lack of a VR.

•

See ipv6 virtual-router.

•

Use to assign a policy list to the ingress or egress of an interface to which the profile is attached.

•

Example host1(config-profile)#l2tp policy secondary-input my-policy

•

Use the no version to remove the association between a policy list and a profile.

•

See l2tp policy.

ppp aaa-profile

Chapter 17: Configuring Dynamic Interfaces

•

Use to assign an AAA profile to static and dynamic, multilink and nonmultilink PPP interfaces.

•

The PPP application associates the AAA profile with the interface and passes the AAA profile to AAA for authentication.

•

If an AAA profile is deleted after it has been assigned to an interface, AAA denies the authentication and logs a message.

•

When you remove an AAA profile, it does not remove any corresponding bindings between PPP interfaces or interface profiles and the AAA profile. If an AAA profile with the same name is added, the interface cannot authenticate until the AAA profile is reassigned.

NOTE: Although an AAA profile and an interface profile have similar functionality, they are not related and you need to treat them differently.

•

Example host1(config-profile)#ppp aaa-profile westford24

•

Use the no version to remove the AAA profile assignment.

ppp authentication

NOTE: For more information about AAA profiles, see JunosE Broadband

Access Configuration Guide.

•

See ppp aaa-profile.

•

Use to require authentication from the PPP peer.

•

To specify the name of a virtual router (VR) to be used as the authentication VR context, use the virtual-router keyword. Keep the following points in mind when you use the ppp authentication virtual-router command:

•

When you specify a VR in the ppp authentication command, AAA does not query the domain map for the assigned VR context. Instead, AAA uses the VR specified in the ppp authentication command as the authentication VR context and issues the authentication request to the authentication server in the assigned VR context.

•

If you specify the default VR as the authentication VR context, AAA loosely binds the user to the default VR. This means that RADIUS can override the default VR context with a new VR context during the authentication process. When the ppp authentication virtual-router command specifies the default VR, AAA returns either the default VR or the VR specified by RADIUS.

•

If you specify a VR other than the default VR as the authentication VR, AAA tightly binds the user to the specified VR. This means that RADIUS cannot override the specified VR context with a new VR context during the authentication process. When

575

JunosE 11.3.x Link Layer Configuration Guide the ppp authentication virtual-router command specifies a nondefault VR, AAA returns the specified VR.

•

If the VR specified in a profile with the ip virtual-router command differs from the

VR provided by AAA, IP uses the VR provided by AAA when the dynamic IP upper-layer interface is created. For more information about using the ip virtual-router command,

see “ip virtual-router” on page 570.

•

The router supports the MD5 authentication algorithm for CHAP authentication.

•

Example 1—Specifies PAP or CHAP as the primary authentication protocol, and the other authentication protocol as the alternative. For example, the following command specifies pap as the primary authentication protocol and chap as the alternate.

host1(config-if)#ppp authentication pap chap

The router requests the use of PAP as the authentication protocol (because it appears first in the command line). If the peer refuses to use PAP, the router requests the CHAP protocol. If the peer refuses to negotiate authentication, the router terminates the PPP session.

NOTE: The JunosE Software’s PPP application accepts null usernames during PAP and CHAP authentication. When the PPP application receives an authentication request that includes a null username, PPP passes the request to AAA. To take advantage of this feature, configure your authentication server to support the use of null usernames.

•

Example 2—Specifies a virtual router for the authentication virtual router context. This command is available in static configurations and in profiles.

host1(config-if)#ppp authentication virtual-router boston pap chap

•

Use the no version to specify that the router does not require authentication.

•

See ppp authentication.

ppp chap-challenge-length

•

Use to modify the length of the CHAP challenge by specifying the minimum length and maximum length.

CAUTION: Do not use the ppp chap-challenge-length command; increasing the minimum length (from the default 16 bytes) or decreasing the maximum length (from the default 32 bytes) reduces the security of your router.

•

Specify the minimum and maximum lengths in bytes in the range 8–63.

•

The maximum length must be greater than or equal to the minimum length.

•

Example

Chapter 17: Configuring Dynamic Interfaces host1(config-profile)#ppp chap-challenge-length 24 28

•

Use the no version to restore the default minimum 16 bytes and default maximum 32 bytes.

•

See ppp chap-challenge-length.

ppp fragmentation

•

Use to enable fragmentation on an MLPPP link interface and optionally specify the maximum fragment size, in octets, to be used on the link.

•

Example host1(config-profile)#ppp fragmentation 128

•

Use the no version to disable fragmentation on the link and restore the default fragment size, which is the link’s MTU.

•

See ppp fragmentation.

ppp hash-link-selection

•

Use to enable use of a hash-based algorithm to select the link on which the router transmits non-best-effort (high-priority) packets, such as voice or video, on the dynamic

MLPPP interfaces created by this profile.

•

Hash-based MLPPP link selection is available only for non-best-effort traffic. For best-effort traffic, the router uses a round-robin algorithm for link selection.

•

Using hash-based link selection instead of the default round-robin link selection for non-best-effort traffic ensures that the router maintains the proper packet order when transmitting high-priority packets.

•

When you configure hash-based link selection, the router uses the IP source address and IP destination address of the packet as a hash to select the MLPPP member link on which to transmit the packet.

•

Example—The following commands configure hash-based MLPPP link selection for all dynamic MLPPP interfaces created by the profile named dynamicMlppp.

host1(config)#profile dynamicMlppp host1(config-profile)#ppp multilink enable host1(config-profile)#ppp hash-link-selection

•

Use the no version to restore the default round-robin algorithm for MLPPP link selection.

•

See ppp hash-link-selection.

ppp initiate-ip

•

Use to initiate IPv4 for passive clients. By default, PPP creates IP instances when it receives client requests.

•

Example host1(config-profile)#ppp initiate-ip

•

Use the no version to disable initiation of IP.

•

See ppp initiate-ip.

577

JunosE 11.3.x Link Layer Configuration Guide

ppp initiate-ipv6

•

Use to initiate IPv6 for passive clients. By default, PPP creates IPv6 instances when it receives client requests.

•

Example host1(config-profile)#ppp initiate-ipv6

•

Use the no version to disable initiation of IPv6.

•

See ppp initiate-ipv6.

ppp ipcp lockout

•

Use to terminate invalid IPv4 subscribers and prevent additional IPCP negotiations.

•

When Internet Protocol version 6 Control Protocol (IPv6CP) is active, this command enables unused IPv4 addresses, which are allocated for the IPv6 subscribers, to be available for the IPCP services for an internally defined time interval (10 seconds).

When the time interval elapses, the subscriber must connect again to negotiate IPCP.

For more information about how the IPv4 addresses are restored, see Chapter 7,

Configuring Point-to-Point Protocol.

•

Example host1(config-subif)#ppp ipcp lockout

•

Use the no version to disable the IPCP lockout option on the interface.

•

See ppp ipcp lockout.

ppp ipcp netmask

•

Use to specify Internet Protocol Control Protocol (IPCP) option 0x90 for each PPP interface. By default, IPCP option 0x90 is disabled on the interface.

•

Example host1(config-profile)#ppp ipcp netmask

•

Use the no version to disable IPCP option 0x90 option on the interface.

•

See ppp ipcp netmask.

ppp ipcp prompt-option dns

•

Use to prompt the CPE (Customer Premises Equipment) to negotiate the IPCP primary and secondary DNS options that are locally available with the broadband remote access server.

•

Use the no version to disable the command

•

See ppp ipcp prompt-option dns

ppp keepalive

Chapter 17: Configuring Dynamic Interfaces

ppp log

•

Use to specify the keepalive timeout value.

•

This command always operates in high-density keepalive mode when PPP is layered over ATM or PPPoE.

•

When the keepalive timer expires, the interface searches for frames received from the peer in the prior keepalive timeout seconds. If the interface finds such frames, it does not send an LCP echo request (keepalive). Keepalive packets are sent only if the peer is silent (no traffic was received from the peer during the previous keepalive timeout interval). If both sides are configured with keepalive, receipt of an LCP echo request by one end suppresses the transmission of an LCP echo request by that end.

•

You can specify a timeout value in the range 30–64800 seconds. The default value is 30 seconds.

•

If the keepalive interval is 30 seconds, a failed link is detected between 90 and 120 seconds after failure.

•

Use ppp keepalive without a value to restore the default, 30 seconds.

•

Example host1(config-profile)#ppp keepalive 50

•

Use the no version to disable keepalive.

•

See ppp keepalive.

•

Use to enable PPP packet or state machine logging on any dynamic interface that uses the profile being configured. Specify one of the following keywords:

• pppPacket—Enables PPP packet logging

• pppStateMachine—Enables PPP state machine logging

•

Example host1(config-profile)#ppp log pppPacket

NOTE: This command is equivalent to the log severity debug pppPacket and log severity debug pppStateMachine commands.

•

Use the no version to disable packet or state machine logging.

•

See ppp log.

ppp magic-number disable

•

Use to disable negotiation of the local magic number.

•

Issuing this command prevents the router from detecting loopback configurations.

•

Example host1(config-profile)#ppp magic-number disable

579

JunosE 11.3.x Link Layer Configuration Guide

•

Use the no version to restore negotiation of the local magic number.

•

See ppp magic-number disable.

ppp magic-number ignore-mismatch

•

Use to cause the router to ignore a mismatch of the LCP peer magic number and retain the PPP connection when the peer has not negotiated an LCP magic number.

•

For more information about using this command, see “Validation of LCP Peer Magic

Number” on page 261 in “Configuring Point-to-Point Protocol” on page 259.

•

To verify configuration of LCP peer magic number validation on the router, use the

show profile command. For information, see “show profile” on page 604.

•

Example host1(config-if)#ppp magic-number ignore-mismatch

•

Use the no version to restore the default behavior, in which the router terminates the

PPP connection if it detects an LCP peer magic number mismatch.

•

See ppp magic-number ignore-mismatch.

ppp max-negotiations

•

Use to configure the maximum number of LCP, IPCP, or IPv6CP renegotiation attempts, in the range 1–65535, that the router accepts before terminating a PPP session.

•

Configuring the maximum number of renegotiation attempts helps avoid massive renegotiation loops that can occur between the router and a noncompliant PPP client.

Such renegotiation loops can cause excessive CPU utilization and can prevent the PPP client from coming up properly.

•

When a PPP client exceeds the configured maximum number of renegotation attempts, the router sends a termination request to end the PPP session. When the PPP session is terminated and LCP goes into a stopped (closed) state, dynamic PPP or MLPPP interface columns are torn down and wait to be recreated when traffic is detected on the interface.

•

If you do not specify the optional lcp, ipcp, or ipv6cp keyword, the ppp max-negotiations command sets the maximum number of renegotiation attempts for each of LCP, IPCP, and IPv6CP to the value you specify, or to the default value (30) if you omit the optional value for maximum renegotiation attempts.

•

When both IPv4 interface columns and IPv6 interface columns are configured over a

PPP link-layer interface, the router terminates the PPP session only when the PPP client exceeds the configured maximum number of renegotiation attempts for both the IPv4 interface and the IPv6 interface.

•

Example 1—Sets the maximum number of LCP renegotiation attempts to 5 host1(config-profile)#ppp max-negotiations lcp 5

•

Example 2—Sets the maximum number of IPCP renegotiation attempts to 30 (the default) host1(config-profile)#ppp max-negotiations ipcp

Chapter 17: Configuring Dynamic Interfaces

•

Example 3—Sets the maximum number of LCP, IPCP, and IPv6CP renegotiation attempts to 15 host1(config-profile)#ppp max-negotiations 15

•

Example 4—Restores the maximum number of LCP, IPCP, and IPv6CP renegotiation attempts to the default value, 30 host1(config-profile)#no ppp max-negotiations

•

Use the no version to restore the default value, 30 renegotiation attempts.

•

See ppp max-negotiations.

ppp mru

•

Use to control the negotiation of the maximum receive unit (MRU).

•

Specify the number of bytes, in the range 64–65535.

•

We recommend you coordinate this value with the network administrator on the other end of the line.

•

If the value configured for the PPP MRU is greater than the value of the lower-layer

MRU minus the PPP header length, the router logs a warning message and uses the lesser of the configured MRU value or the lower-layer MRU value minus the PPP header length to negotiate the local MRU.

•

If the value configured for the PPP MRU conflicts with a similar value configured for another protocol, such as the MTU value for PPPoE, the router uses the lesser of the two values.

•

Example host1(config-if)#ppp mru 576

•

Use the no version to restore the default value, which causes PPP to use the lower-layer

MRU minus the PPP header length as the MRU value. added per mkelkar for fix to cqid

72648 (FranS)

•

See ppp mru.

ppp multilink enable

•

Use in a profile to enable the creation of dynamic MLPPP interfaces.

•

Example host1 (config-profile)#ppp multilink enable

•

Use the no version to cause the LNS to reject any incoming requests to create dynamic

MLPPP interfaces.

•

See ppp multilink enable.

ppp multilink multiclass

•

Use in a profile to enable multiclass MLPPP and the creation of multilink classes on a dynamic MLPPP interface.

•

Example

581

JunosE 11.3.x Link Layer Configuration Guide host1 (config-profile)#ppp multilink multiclass multilink-classes 6

•

Use the no version to disable multiclass MLPPP or to restore the number of multilink classes to the default value, 1.

•

See ppp multilink multiclass.

ppp multilink multiclass fragmentation

•

Use to enable fragmentation on a multilink class on a dynamic MLPPP interface.

•

Example host1(config-profile)#ppp multilink multiclass fragmentation best-effort voice low-loss video

•

Use the no version to disable fragmentation on a multilink class.

•

See ppp multilink multiclass fragmentation.

ppp multilink multiclass reassembly

•

Use to enable reassembly on a multilink class on a dynamic MLPPP interface.

•

Example host1(config-profile)#ppp multilink multiclass reassembly best-effort voice low-loss video

•

Use the no version to disable reassembly on a multilink class.

•

See ppp multilink multiclass reassembly.

ppp multilink multiclass traffic-class

•

Use to configure mapping of QoS traffic classes to multilink classes on a dynamic

MLPPP interface.

•

Example host1(config-profile)#ppp multilink multiclass traffic-class best-effort voice low-loss video

•

Use the no version to delete the mapping of QoS traffic classes to multilink classes.

•

See ppp multilink multiclass traffic-class.

ppp passive-mode

•

Use to force a static or dynamic PPP interface into passive mode before LCP negotiation begins, for a period of one second. This delay enables slow clients to start up and initiate the LCP negotiation.

•

Example host1(config-profile)#ppp passive-mode

•

Use the no version to disable passive mode.

•

See ppp passive-mode.

ppp peer

Chapter 17: Configuring Dynamic Interfaces

ppp reassembly pppoe acName pppoe always-offer

•

Use to resolve conflicts when the router and the PPP peer system have the primary and secondary DNS and WINS addresses configured with different values.

•

By default, the DNS and WINS addresses configured on the router take precedence.

•

Use the ppp peer dns command or the ppp peer wins command to configure the PPP peer system as the one that takes precedence. The ppp peer command has no effect unless both systems have the address configured and the address is in conflict. If the

PPP peer system has the address and the router does not, the peer always supplies the address regardless of how you have configured the PPP peer.

•

Example host1(config-profile)#ppp peer dns

•

Use the no ppp peer dns command or the no ppp peer wins command when you want the router to take precedence during setup negotiations between the router and the remote PC client. If the IP addresses passed to the router by the remote PC client differ from the ones you have configured on your router, the router returns the values that you configured as the correct values to the remote PC client.

•

See ppp peer.

•

Use to enable reassembly on an MLPPP link interface and optionally specify the administrative MRRU value, in octets, for the link.

•

Example host1(config-profile)#ppp reassembly 1590

•

Use the no version to disable reassembly on the link and restore the default value, which is the link’s local MRU.

•

See ppp reassembly.

•

Use to add an access concentrator (AC) name to the profile configuration.

•

Example host1(config-profile)#pppoe acName CYM9876

•

Use the no version to remove the AC name.

•

See pppoe acName.

•

Use to set up the router to offer to set up a session for the client, even if the router has insufficient resources to establish a session.

•

This feature is disabled by default.

•

Example host1(config-profile)#pppoe always-offer

583

JunosE 11.3.x Link Layer Configuration Guide

•

Use the no version to disable this feature.

•

See pppoe always-offer.

pppoe duplicate-protection

•

Use to prevent a client from establishing more than one session using the same MAC address.

•

This feature is disabled by default.

•

Example host1(config-profile)#pppoe duplicate-protection

•

Use the no version to disable duplicate protection.

•

For PPPoE sessions that contain the IWF-Session DSL Forum VSA (26-254) in the

PADR packets sent from the client to the PPPoE access concentrator, multiple subscriber sessions with the same MAC address can originate. This behavior occurs because the interworking functionality (IWF) causes a PPPoE over ATM or PPP over

ATM (PPPoA) session to be converted by the digital subscriber line access multiplexer

(DSLAM) into a PPPoE session. As a result of this conversion, the MAC addresses of all IWF PPPoE sessions contain the MAC address of the DSLAM device.

For PPPoE sessions with the IWF-Session VSA, duplication of MAC addresses is configured by default. Regardless of whether you enabled duplicate protection, multiple

IWF PPPoE sessions with the same MAC address (the address of the DSLAM device) are not terminated until the limit on the maximum number of PPPoE sessions configured on the major interface is reached.

See “Guidelines for Configuring Duplicate Protection for IWF PPPoE Sessions” on page 391 for a list of considerations to be observed when you use the duplicate protection

feature for IWF PPPoE sessions

•

See pppoe duplicate-protection

pppoe log pppoeControlPacket

•

Use to enable packet trace logging on PPPoE dynamic interfaces created with this profile. Packet trace information is logged to the pppoeControlPacket log.

•

Example host1(config-profile)#pppoe log pppoeControlPacket

•

Use the no version to turn off packet trace logging.

•

See pppoe log pppoeControlPacket.

pppoe mtu

•

Use to cause the PPPoE application to send the string to the new client created when the profile is dynamically attached to an IP interface.

•

The message string is saved in nonvolatile storage (NVS).

•

Example host1(config-profile)#pppoe motm string

Chapter 17: Configuring Dynamic Interfaces

•

Use the no version to disable the command.

•

See pppoe motm.

pppoe mtu

•

Use to set the MTU using a combination of lower layer restrictions and controls.

•

You can specify an MTU greater than the current maximum permitted by RFC 2516, in the range 66–65535.

•

You can use the use-lower-layer keyword to use the lower layer interface value minus any PPPoE overhead. You can use the use-mtu-tag keyword to use the provided PPPoE mtu tag value.

•

Example host1(config-profile)#pppoe mtu 1380

•

Use the no version to restore the default value, 1494.

•

See pppoe mtu.

pppoe remote-circuit-id

•

Use to enable the router to capture and process a vendor-specific tag containing a remote circuit ID transmitted from a DSLAM device.

•

Optionally, the router can use the remote circuit ID in place of either or both of the

Calling-Station-Id [31] and NAS-Port-Id [87] RADIUS attributes to uniquely identify subscriber locations.

•

Example host1(config-profile)#pppoe remote-circuit-id

•

Use the no version to restore the default behavior, which is not to capture and process the remote circuit ID.

•

See pppoe remote-circuit-id.

pppoe service-name-table

•

Use to assign a PPPoE service name table to dynamic interfaces created with this profile.

•

A PPPoE service name table defines the set of specific service name tags that an AC, such as an E Series router, offers to PPPoE clients. It also controls whether the router responds to or does not respond to client requests containing an empty service name tag.

•

Specify the name of the PPPoE service name table configured with the pppoe service-name-table command from Global Configuration mode.

•

Example host1(config-profile)#pppoe service-name-table myServiceTable1

•

Use the no version to remove the PPPoE service name table assignment.

•

See pppoe service-name-table.

585

JunosE 11.3.x Link Layer Configuration Guide

pppoe sessions pppoe url

•

Use to specify the maximum number of PPPoE subinterfaces permitted on an interface, in the range 1–8000 (ERX routers) or 1–32,000 (E120 and E320 routers). On the ES2

10G ADV LM (E120 and E320 routers), you can have PPPoE subinterfaces in the range

1–32,000. The default value is 8000 (ERX routers) or 16,000 (E120 and E320

Broadband Services Routers) or 32,000 (ES2 10G ADV LM).

•

The sessions command affects only the creation of subinterfaces after the command is entered. Previously created interfaces remain, even if their number exceeds the new value of the sessions parameter.

NOTE: The number of subinterfaces permitted on the interface for E120 and E320 routers is in the range 1–32,000 irrespective of the type of line module. However, if you specify a value greater than the number of subinterfaces supported by a line module, the number of subinterfaces created is the default maximum value for that line module. For example, if you specify the number of subinterfaces for a ES2 4G LM as 32,000 interfaces, the number of subinterfaces created is 16,000, which is the default maximum value for the ES2 4G LM.

•

Example host1(config-profile)#pppoe sessions 3000

•

Use the no version to restore the default value, 8000 (ERX routers) or 16,000 (E120 and E320 routers) or 32,000 (ES2 10G ADV LM).

•

See pppoe sessions.

•

Use in a profile to cause the PPPoE application to send the string to the new client created when the profile is dynamically attached to an IP interface.

•

The message string is saved in nonvolatile storage (NVS).

•

PPPoE substitutes certain characters for information in the specified URL string before transmitting:

•

%U username and domain name

•

%u username

•

%d domain name

•

%D profile name

•

%% % character

•

Example host1(config-profile)#pppoe url http://www.relevanturl.com

Chapter 17: Configuring Dynamic Interfaces

•

Use thenoversion to disable the command.

•

See pppoe url.

profile

•

Use to create a profile.

•

You specify a profile name with up to 80 alphanumeric characters.

•

Example host1(config)#profile foo

•

Use the no version to remove a profile.

•

See profile.

svlan ethertype

•

Use to assign an Ethertype value for the S-VLAN subinterface in a profile.

•

Choose one of the following Ethertype values:

•

8100—Specifies Ethertype value 0x8100, as defined in IEEE Standard 802.1q

•

88a8—Specifies Ethertype value 0x88a8, as defined in draft IEEE Standard 802.1ad

•

9100—Specifies Ethertype value 0x9100, which is the default

•

Use an Ethertype value that matches the Ethertype value set on the customer premises equipment (CPE) to which your router connects.

•

Example host1(config-profile)#svlan ethertype 8100

•

Use the no version to restore the default value, 9100.

•

See svlan ethertype.

vlan advisory-rx-speed

•

Use to set an advisory receive speed for VLAN subinterfaces that are created with the profile you are configuring. For detailed information about how to use this command,

see “vlan advisory-rx-speed” on page 669.

•

Example host1(config-profile)#vlan advisory-rx-speed 2000

•

Use the no version to restore the default behavior—the Rx speed is not sent to the LNS.

•

See vlan advisory-rx-speed.

vlan advisory-tx-speed

•

Use to set an advisory connect speed for VLAN subinterfaces that are created with the profile that you are configuring.For detailed information about how to use this command,

see “vlan advisory-tx-speed” on page 669.

•

Example

587

JunosE 11.3.x Link Layer Configuration Guide host1(config-profile)#vlan advisory-tx-speed 2000

•

Use the no version to restore the default behavior—the Tx speed is not sent to the LNS.

•

See vlan advisory-tx-speed.

vlan auto-configure

•

Use to specify the types of dynamic upper-interface encapsulations that are accepted or detected by a dynamic VLAN subinterface.

•

Include this command in the base profile for a dynamic VLAN subinterface.

•

Example host1(config-profile)#vlan auto-configure ip

•

Use the no version to terminate detection of the specified encapsulation type.

•

See vlan auto-configure.

vlan auto-configure agent-circuit-identifier

•

Use to create a VLAN subinterface that is based on the agent-circuit-id information in the option 82 field of DHCP messages or in the DSL Forum VSA 26-1 of PPPoE PADR and PADI packets.

•

Include this command in the base profile for a dynamic VLAN subinterface.

•

Example host1(config-profile)#vlan auto-configure agent-circuit-identifier

•

Use the no version to disable creation of VLAN subinterfaces based on agent-circuit-identifier information.

•

See vlan auto-configure agent-circuit-identifier

vlan description

•

Use to assign a description to VLAN subinterfaces that are created with this profile.

•

You can use a maximum of 64 characters for the description or to name the alias.

•

Example host1(config-profile)#vlan description test1

•

Use the no version to remove the VLAN description.

•

See vlan description.

vlan policy

•

Use to assign a VLAN policy list to an interface.

•

For more information about keywords, see “vlan policy” on page 672.

•

Example host1(config-profile)#vlan policy input VlanPolicy33 statistics enabled preserve

Chapter 17: Configuring Dynamic Interfaces

•

Use the no version to remove the association between a policy list and an interface or a profile.

•

See vlan policy.

vlan profile

•

Use to add a nested profile assignment to a base profile for a dynamic VLAN subinterface.

•

A nested profile assignment references another profile that configures attributes for a dynamic upper-interface type over the VLAN subinterface.

•

Examples host1(config-profile)#vlan profile pppoe vlanProfilePppoe host1(config-profile)#vlan profile ip vlanProfileIP

•

Use the no version to remove the profile assignment for the upper-interface encapsulation type.

•

See vlan profile.

vlan service-profile

•

Use to specify a service profile name for a dynamic VLAN and to enter Service Profile

Configuration mode. Service profiles contain user and password information, and are used in route maps for subscriber management and to authenticate subscribers with

RADIUS.

•

You can specify a service profile name with up to 80 alphanumeric characters.

•

Example host1(config)#vlan service-profile vlanClass1Service host1(config-service-profile)#

•

Use the no version to delete the service profile.

•

See vlan service-profile.

Assigning a Profile to an Interface

Use the profile command from Interface Configuration mode when you assign a profile to an interface.

For static PPP interfaces, you can assign only a profile for IP encapsulations. For static

ATM 1483 subinterfaces, you can assign one profile for each bridged Ethernet, IP, PPP, and PPPoE encapsulation. For static VLAN subinterfaces, you can assign one profile for each IP or PPPoE encapsulation. You can also use the default keyword any, which applies to any autoconfigured encapsulation that does not have specific profile assignment.

For example, the following commands cause the router to use ProfileB when an IPoA packet is received, and to use ProfileA for any other received encapsulation that is autoconfigured. When you omit the keyword, it defaults to any.

host1(config-subif)#profile any ProfileA host1(config-subif)#profile ip ProfileB

589

JunosE 11.3.x Link Layer Configuration Guide

atm pvc auto-configure

To assign a profile to an interface:

Configure a physical interface.

host1(config-if)#interface atm 2/1.10

Configure a PVC by specifying the VCD, the VPI, the VCI, and the encapsulation type.

host1(config-subif)#atm pvc 10 100 22 aal5snap host1(config-subif)#atm pvc 10 100 22 aal5autoconfig

Apply an existing profile.

host1(config-subif)#profile ip holland

Assign subscriber identification.

host1(config-subif)#subscriber ip user ispname domain abc.com

password 3fds9jpt

Enable the dynamic encapsulation type.

host1(config-subif)#auto-configure ip

•

Use to configure a PVC on an ATM interface. Select one of the following encapsulation options:

• aal5autoconfig—Enables the autodetection of the 1483 encapsulation (LLC/SNAP or VC multiplexed).

• aal5snap—Specifies a LLC encapsulated circuit; the LLC/SNAP header precedes the protocol datagram.

• aal5mux ip—Specifies a VC multiplexed circuit. This option is used for IP only.

•

Example host1(config-subif)#atm pvc 6 0 11 aal5autoconfig

•

Use the no version to remove the specified PVC.

•

See atm pvc.

•

Use to configure an ATM subinterface to support a dynamic interface. Specifies one or more types of dynamic encapsulation that the ATM 1483 subinterface detects and accepts.

•

For detailed information about how to use this command, see “auto-configure” on page 528.

•

Example 1—Enables autodetection for the bridged Ethernet encapsulation type using the default lockout time range, 1–300 seconds host1(config-subif)#auto-configure bridgedEthernet

•

Example 2—Enables autodetection for the bridged Ethernet encapsulation type using a nondefault lockout time range of 3600–21600 seconds (1–6 hours)

Chapter 17: Configuring Dynamic Interfaces host1(config-subif)#auto-configure bridgedEthernet lockout-time 3600 21600

•

Example 3—Disables encapsulation type lockout for the IP encapsulation type host1(config-subif)#auto-configure ip lockout-time none

•

Example 5—Permanently locks out the PPP encapsulation type until the auto-configure ppp command is issued host1(config-subif)#no auto-configure ppp

•

Use the no version to terminate detection of the specified encapsulation type or, if the lockout-time keyword is specified, to restore the lockout time range to its default value,

1–300 seconds.

•

See auto-configure.

profile

•

Use to assign a profile to a static ATM 1483 or static PPP interface. The profile configuration is used to dynamically configure an upper bridged Ethernet, IP, PPP, or

PPPoE interface.

•

The default encapsulation type, any, applies to any autoconfigured encapsulation that does not have a specific profile assignment.

•

Example host1(config-subif)#profile ip holland

•

Use the no version to remove the profile assignment from the interface.

•

See profile,

subscriber

•

Use to configure a local subscriber on the router to support authentication and configuration from RADIUS for a dynamic IPoA or bridged Ethernet interface.

•

For detailed information about how to use this command, see “subscriber” on page 553.

•

Example host1(config-subif)#subscriber ip user-prefix charlie domain myisp password-prefix lucy

•

Use the no version to remove the subscriber.

•

See subscriber.

Profile Configuration Examples

The following examples show different ways to configure profiles.

•

This example configures a new profile with IP characteristics only.

591

JunosE 11.3.x Link Layer Configuration Guide host1(config)#profile ProfileA host1(config-profile)#ip mtu 1024 host1(config-profile)#exit

• This example shows a new profile configured with both IP and PPP characteristics.

host1(config)#profile ProfileB host1(config-profile)#ip mtu 512 host1(config-profile)#ppp authentication chap host1(config-profile)#ppp keepalive 120 host1(config-profile)#exit

• This example shows a new profile configured with IP, PPP, and PPPoE characteristics.

host1(config)#profile ProfileC host1(config-profile)#ip mtu 1400 host1(config-profile)#ppp authentication chap host1(config-profile)#ppp keepalive 60 host1(config-profile)#pppoe sessions 64 host1(config-profile)#exit

• This example uses the profiles created in the previous three examples. It shows distinct profiles for each encapsulation, where the configuration of dynamic layers varies according to which incoming encapsulation the ATM 1483 subinterface detects.

Autodetection is enabled for the IP encapsulation type with the default lockout time range, 1–300 seconds.

host1(config)#interface atm 4/0.1

host1(config-subif)#atm pvc 10 100 22 aal5autoconfig host1(config-subif)#profile ip ProfileA host1(config-subif)#profile ppp ProfileB host1(config-subif)#profile pppoe ProfileC host1(config-subif)#subscriber ip user atm1 domain isp1 password atm1pw host1(config-subif)#auto-configure ip host1(config-subif)#auto-configure ppp host1(config-subif)#auto-configure pppoe host1(config-subif)#exit

•

This example also uses the three new profiles configured in the first three examples.

It shows one profile being used for all encapsulations. The configuration of dynamic layers is the same regardless of incoming encapsulations detected by ATM. Only relevant profile attributes are used for whichever dynamic interface layers are actually constructed.

host1(config)#interface atm 4/0.2

host1(config-subif)#atm pvc 200 0 200 aal5autoconfig host1(config-subif)#profile any ProfileC host1(config-subif)#subscriber ip user atm2 domain isp2 password atm2pw host1(config-subif)#auto-configure ip host1(config-subif)#auto-configure ppp host1(config-subif)#auto-configure pppoe host1(config-subif)#exit

•

This example uses the three new profiles configured in the first three examples, and is implicitly assigned via the any encapsulation wildcard. Configuration of dynamic layers is the same regardless of incoming encapsulation detected by ATM.

Chapter 17: Configuring Dynamic Interfaces

Autodetection is enabled for the IP encapsulation type with a lockout time range of

3600–7200 seconds (1–2 hours).

host1(config)#interface atm 4/0.3

host1(config-subif)#atm pvc 300 0 300 aal5autoconfig host1(config-subif)#profile any ProfileC host1(config-subif)#subscriber ip user atm2 domain isp3 password atm3pw host1(config-subif)#auto-configure ip lockout-time 3600 7200 host1(config-subif)#auto-configure ppp host1(config-subif)#auto-configure pppoe host1(config-subif)#exit

• This example uses the profile configured in the first example. Autodetection is enabled for the bridged Ethernet encapsulation type with a lockout time range of 3600–21600 seconds (1–6 hours).

host1(config)#interface atm 4/0.3

host1(config-subif)#atm pvc 300 0 300 aal5autoconfig host1(config-subif)#profile bridgedEthernet ProfileA host1(config-subif)#subscriber bridgedEthernet user atm3 domain isp1 password fjdkei host1(config-subif)#auto-configure bridgedEthernet lockout-time 3600 21600

Scripts and Macros

Scripts and macros are intended to reduce the management of static interfaces. Because dynamic interfaces have static lower layers, you can use scripts and macros to configure the static portion of all dynamic interfaces.

A script or macro can specify the static interface by using the interface, auto-configure, subscriber, or profile commands. These commands enable you to configure the interface as dynamic and to specify configuration sources for the dynamic upper layers. These files can then be executed by the router as though the commands were entered at the terminal.

•

Scripts—You can create script files containing a series of CLI commands. The resulting script can be executed via the configure file command.

• Macros—You can create macros that generate and execute CLI commands. You first write macros on a computer and then copy them to the router. You issue the macro command from the CLI to execute both local macros or macros stored remotely. The macro command is available from all command modes. See chapter Writing CLI Macros in JunosE System Basics Configuration Guide.

NOTE: For a list of vendor-specific attributes (VSAs) that apply to dynamic interfaces, see JunosE Broadband Access Configuration Guide.

Monitoring Upper-Layer Dynamic Interfaces and Profiles

You can use the show commands described in this section to monitor configurations created with dynamic interfaces and profiles.

593

JunosE 11.3.x Link Layer Configuration Guide

NOTE: The E120 and E320 routers output for monitor and show commands is identical to output from other E Series routers, except that the E120 and

E320 routers output also includes information about the adapter identifier in the interface specifier (slot/adapter/port).

show atm aal5 interface

•

Use to display information about a configured ATM AAL5 interface.

•

Field descriptions

•

AAL5 Interface operational status—Operational status of the AAL5 interface: up, down, lowerLayerDown

• time since last status change—Time since last reported change to the AAL5 interface operational status in hh:mm:ss format

•

SNMP trap link-status—Whether SNMP link status traps are enabled or disabled on the ATM AAL5 interface

•

Auto configure ATM 1483 status—Whether the autoconfiguration feature for a dynamic ATM 1483 subinterface configured over the ATM AAL5 interface is enabled or disabled

•

InPackets—Number of packets received on this interface

•

InBytes—Number of bytes received on this interface

•

OutPackets—Number of packets transmitted on this interface

•

OutBytes—Number of bytes transmitted on this interface

•

InErrors—Number of incoming errors received on this interface

•

OutErrors—Number of outgoing errors on this interface

•

InPacketDiscards—Number of incoming packets discarded on this interface

•

OutDiscards—Number of outgoing packets discarded on this interface

•

Example host1# show atm aal5 interface atm 3/0

AAL5 Interface ATM 3/0 operational status: lowerLayerDown

time since last status change: 00:08:46

SNMP trap link-status: disabled

Auto configure ATM 1483 status: disabled

InPackets: 0

InBytes: 0

OutPackets: 0

OutBytes: 0

InErrors: 0

OutErrors: 0

Chapter 17: Configuring Dynamic Interfaces

InPacketDiscards: 0

OutDiscards: 0

•

See show atm aal5 interface.

show atm subinterface

•

Use to display the current state of all ATM subinterfaces, all ATM subinterfaces configured on a specified ATM physical interface, or a specific ATM subinterface.

•

To specify an ATM subinterface for ERX7xx models, ERX14xx models, and ERX310 router, use the slot/port.subinterface format.

•

slot—Number of the chassis slot

•

port—Port number on the I/O module

•

subinterface—Number of the subinterface in the range 1–2147483647

•

To specify an ATM subinterface for E120 and E320 routers, use the

slot/adapter/port.subinterface format.

•

slot—Number of the chassis slot

•

adapter—Identifier for the IOA within the E320 chassis, either 0 or 1, where:

•

0 indicates that the IOA is installed in the right IOA bay (E120 router) or the upper

IOA bay (E320 router).

•

1 indicates that the IOA is installed in the left IOA bay (E120 router) or the lower

IOA bay (E320 router).

•

port—Port number on the IOA

•

subinterface—Number of the subinterface in the range 1–2147483647

•

To display brief summary information for all ATM subinterfaces, or for ATM subinterfaces configured on a specified ATM physical interface, use the summary keyword.

•

To display status information only for ATM subinterfaces with a specific operating status, use the status keyword with one of the following status values. (See the Status field description for an explanation of these values.)

• dormant

• dormantLockout

• down

• lowerLayerDown

• notPresent

• up

•

To display the current state of an ATM subinterface created on the PVC with the specified VPI and VCI values, use the atm slot/port/vpi/vci format (for ERX7xx models,

595

JunosE 11.3.x Link Layer Configuration Guide

596

ERX14xx models, and ERX310 router) or the slot/adapter/port/vpi/vci format (for E120 and E320 routers) to identify the ATM subinterface (Example 5).

NOTE: You can use the atm slot/port/vpi/vci format as an alternative to the atm slot/port.subinterface format with the specific show interface and show subinterface commands to monitor all ATM 1483 subinterfaces

(except NBMA interfaces) as well as the upper-layer interfaces configured over an ATM 1483 subinterface. You cannot, however, use the atm

slot/port/vpi/vci format to create or modify an ATM 1483 subinterface.

These guidelines also apply to E120 and E320 routers when you use the atm slot/adapter/port/vpi/vci format as an alternative to the atm slot/adapter/port.subinterface format.

•

For more information, see “Creating a Basic Configuration” on page 21 in “Configuring

ATM” on page 3.

•

Field descriptions

•

Interface—Interface identifier

•

ATM-Prot—One of the following ATM protocol types:

•

RFC-1483—Multiprotocol encapsulation over AAL5

•

NBMA—Nonbroadcast multiaccess interface

•

ATM/MPLS—Local ATM passthrough interface

•

VCD—Virtual circuit descriptor

•

VPI—Virtual path identifier

•

VCI—Virtual circuit (or channel) identifier

•

Circuit Type—Type of circuit: PVC

•

Encap—Administered encapsulation method based on what was configured with the atm pvc command

•

MTU—Maximum transmission unit size for the interface

•

Status—One of the following ATM 1483 subinterface states:

• absent—Represents the notPresent state and indicates that, although the SRP detects the ATM 1483 subinterface, the module on which the subinterface resides has not completed booting up, has failed, or is disabled.

• dormant—Indicates that the ATM 1483 subinterface is performing autodetection of one or more upper-layer encapsulation types and is waiting to receive a packet of that type on a lower-layer interface. An ATM 1483 subinterface transitions from the dormant state to the up state when the router receives a valid packet of the specified encapsulation type on the interface.

Chapter 17: Configuring Dynamic Interfaces

• dormantLockout—Indicates that a dormant ATM 1483 subinterface has one or more upper-layer encapsulation types currently undergoing encapsulation type lockout. An ATM 1483 subinterface transitions from the dormantLockout state to the dormant state when the lockout time expires for all upper-layer encapsulation types undergoing lockout. An ATM 1483 subinterface transitions from the dormantLockout state to the up state when the router receives a valid packet for an encapsulation type that is configured for autodetection but is not undergoing lockout.

• down—Indicates that the ATM 1483 subinterface is administratively disabled or has a circuit that is down or not configured.

• lowerLayerDown—Indicates that a lower-layer interface below the ATM 1483 subinterface is down.

• up—Indicates that the ATM 1483 subinterface is up and able to transfer data. For an ATM 1483 subinterface that supports one or more dynamic upper-layer interfaces, indicates that the router has created the dynamic upper-layer interface or is in the process of creating it.

•

Interface Type—Type of ATM 1483 subinterface: dynamic or static

•

Auto configure status—Setting of the autoconfiguration feature

• dynamic—Autodetection is on; the router automatically detects the next upper interface

• static—Autodetection is off

•

Auto configure interface(s)—Types of dynamic upper interfaces configured with the auto-configure command: bridged Ethernet, IP, PPP, or PPPoE

•

Detected 1483 encapsulation—If the encapsulation type is set to aal5autoconfig, displays the 1483 encapsulation type detected on the subinterface (displays AUTO until a packet is detected)

•

Detected dynamic interface—Type of dynamic upper interface detected during autoconfiguration: bridged Ethernet, IP, PPP, PPPoE, or (if no packet has been received) none

•

Interface types in lockout—Encapsulation types currently experiencing lockout: bridged Ethernet, IP, PPP, PPPoE, or none

•

Lockout state (seconds)—Settings of encapsulation type lockout for the upper-layer encapsulation type indicated

•

Min—Minimum lockout time, in seconds

•

Max—Maximum lockout time, in seconds

•

Current—Current lockout time, in seconds; displays 0 (zero) if lockout is not occurring

597

JunosE 11.3.x Link Layer Configuration Guide

598

•

Elapsed—Time elapsed into the lockout time, in seconds; displays 0 (zero) if lockout is not occurring

•

Next—Lockout time for the router to use for the next lockout event, in seconds

•

Assigned profile—For each dynamic interface type, indicates whether or not a profile is assigned and, if assigned, displays the profile name

•

Subscriber info—Subscriber login information for the specified dynamic interface type (bridged Ethernet or IP)

•

SNMP trap link-status—Trap link status: enabled or disabled

•

InPackets—Number of packets received on this interface

•

InBytes—Number of bytes received on this interface

•

OutPackets—Number of packets transmitted on this interface

•

OutBytes—Number of bytes transmitted on this interface

•

InErrors—Number of errors received on this interface

•

OutErrors—Number of outgoing errors on this interface

•

InPacketDiscards—Number of incoming packets discarded on this interface

•

InPacketsUnknownProtocol—Number of incoming packets with an unknown protocol type

•

OutDiscards—Number of outgoing packets discarded on this interface

•

Example 1—Displays the current state of all ATM subinterfaces host1# show atm subinterface

Circuit Interface

Interface ATM-Prot VCD VPI VCI Type Encap MTU Status Type

----------- -------- --- --- --- ----- ----- ---- ----------- -------

ATM 2/0.101 RFC-1483 101 0 101 PVC AUTO 9180 dormantLockout Static

ATM 2/0.102 RFC-1483 102 0 102 PVC AUTO 9180 up Dynamic

ATM 2/0.103 RFC-1483 103 0 103 PVC AUTO 9180 dormant Static

3 interface(s) found

•

Example 2—Displays summary information for all ATM subinterfaces shown in Example

1 host1# show atm subinterface summary

3 subinterfaces: 1 up, 0 down,

1 dormant, 1 dormantLockout,

0 lowerLayerDown, 0 not present

•

Example 3—Displays status information for all ATM subinterfaces in the dormantLockout state host1# show atm subinterface status dormantLockout

Circuit Interface

Interface ATM-Prot VCD VPI VCI Type Encap MTU Status Type

---------- -------- --- --- --- ------ ----- ---- ------------- ---------

Chapter 17: Configuring Dynamic Interfaces

ATM 2/0.101 RFC-1483 101 0 101 PVC AUTO 9180 dormantLockout Static

1 interface(s) found

•

Example 4—Displays the current state of a specific ATM subinterface host1# show atm subinterface atm 2/0.101

Circuit Interface

Interface ATM-Prot VCD VPI VCI Type Encap MTU Status Type

----------- -------- --- --- --- ----- ----- ---- ------------ ---------

ATM 2/0.101 RFC-1483 101 0 101 PVC AUTO 9180 dormantLockout Static

Auto configure status : dynamic

Auto configure interface(s) : IP bridgedEthernet PPP PPPoE

Detected 1483 encapsulation : AUTO

Detected dynamic interface : none

Interface types in lockout : IP

Lockout state (seconds) : Min Max Current Elapsed Next

------------------------------- --- ---- ------- ------- ----

IP 1 30 16 7 30

BridgedEnet 900 3600 0 0 900

PPP 1 300 0 0 1

PPPoE 1 300 0 0 1

Assigned profile (IP) : ipoa

Assigned profile (BridgedEnet): beth

Assigned profile (PPP) : ppptest

Assigned profile (PPPoE) : pppoetest

Assigned profile (any) : none assigned

BridgedEnet subscriber info :

Username: [email protected]

Password: putty

Authenticate: enabled

SNMP trap link-status: disabled

InPackets: 0

InBytes: 1904

OutPackets: 0

OutBytes: 0

InErrors: 0

OutErrors: 0

InPacketDiscards: 14

InPacketsUnknownProtocol: 0

OutDiscards: 0

1 interface(s) found

•

Example 5—Displays the current state of a specific ATM subinterface created on the

PVC with the specified VPI and VCI values host1# show atm subinterface atm 0/0/0/101

Circuit Interface

Interface ATM-Prot VCD VPI VCI Type Encap MTU Status Type

----------- -------- --- --- --- ------- ----- ---- ------ ---------

ATM 0/0.101 RFC-1483 101 0 101 PVC AUTO 9180 up Static

Auto configure status : dynamic

Auto configure interface(s) : PPPoE

Detected 1483 encapsulation : SNAP

Detected dynamic interface : PPPoE

Interface types in lockout : none

599

JunosE 11.3.x Link Layer Configuration Guide

show atm vc

Lockout state (seconds) : Min Max Current Elapsed Next

------------------------------- --- --- ------- ------- ----

PPPoE 1 300 0 0 1

Assigned profile (IP) : none assigned

Assigned profile (BridgedEnet): none assigned

Assigned profile (PPP) : none assigned

Assigned profile (PPPoE) : pppoeprofile

Assigned profile (any) : none assigned

SNMP trap link-status: disabled

InPackets: 5119

InBytes: 358672

OutPackets: 5107

OutBytes: 357510

InErrors: 0

OutErrors: 0

InPacketDiscards: 3

InPacketsUnknownProtocol: 0

OutDiscards: 0

1 interface(s) found

•

See show atm subinterface.

•

Use to display a summary of all configured ATM VCs and reserved VC ranges.

•

You can specify one or more of the following keywords individually or in combination:

• vpi—Displays VCs on a specific VPI

• category—Displays VCs that have a specific service category

• status—Displays VCs with a certain status

•

To display only a summary of all reserved VC ranges on the router, specify the reserved keyword with no other keywords. This includes VPI/VCI ranges reserved for use by dynamic ATM 1483 subinterfaces.

•

Field descriptions

•

Interface—Interface identifier

•

VPI—Virtual path identifier

•

VCI—Virtual channel identifier

•

VCD—Virtual circuit descriptor

•

Type—Type of circuit: PVC

•

Encap—Encapsulation method: AUTO, AAL5, MUX, SNAP, ILMI, F4-OAM

•

Category—Service type configured on the VC: UBR, UBR-PCR, NRT-VBR, RT-VBR, or CBR

•

Rx/Tx Peak—Peak rate, in Kbps

Chapter 17: Configuring Dynamic Interfaces

show columns

•

Rx/Tx Avg—Average rate, in Kbps

•

Rx/Tx Burst—Maximum number of cells that can be burst at the peak cell rate

•

Status—State of the virtual circuit: Up or Down

•

Start VPI—Starting virtual path identifier (inclusive) of the reserved VC range

•

Start VCI—Starting virtual circuit identifier (inclusive) of the reserved VC range

•

End VPI—Ending virtual path identifier (inclusive) of the reserved VC range

•

End VCI—Ending virtual circuit identifier (inclusive) of the reserved VC range

•

Example 1—Displays all VCs and reserved VC ranges on the router host1# show atm vc

Cate Rx/Tx Rx/Tx Rx/Tx Sta

Interface VPI VCI VCD Type Encap gory Peak Avg Burst tus

------------ --- ---- ---- ---- ----- ---- ----- ----- ----- ---

ATM 3/0.2 0 101 4375 PVC AUTO CBR 1000 0 0 UP

ATM 3/0.3 0 102 4376 PVC AUTO CBR 1000 0 0 DOWN

...

ATM 3/0.8099 1 8099 8099 PVC SNAP UBR 0 0 0 UP

ATM 3/0.8100 1 8100 8100 PVC SNAP UBR 0 0 0 DOWN

8000 circuit(s) found

Reserved VCC ranges:

Start Start End End

Interface VPI VCI VPI VCI

--------- ----- ----- --- ---

ATM 2/0 2 100 2 102

ATM 2/0 3 300 3 303

2 reservation(s) found

•

Example 2—Displays all reserved VC ranges on the router host1# show atm vc reserved

Reserved VCC ranges:

Start Start End End

Interface VPI VCI VPI VCI

--------- ----- ----- --- ---

ATM 2/0 2 100 2 102

ATM 2/0 3 300 3 303

2 reservation(s) found

•

See show atm vc.

•

Use to display static and dynamic interface counts for each interface column.

•

Counts for PPP and PPPoE interface columns are updated when the PPP layer comes up.

•

Counts for bridged Ethernet and IP over ATM columns are updated when the ATM layer comes up.

601

JunosE 11.3.x Link Layer Configuration Guide

•

Field descriptions

•

Type—Interface type

•

Total—Total number of interfaces on this column

•

Static—Number of static interfaces on this column

•

Dynamic—Number of dynamic interfaces on this column

•

Example host# show columns

Interface columns:

------------------

Type Total Static Dynamic

-------------------- ---------- ---------- ----------

Bridged Ethernet 4 2 2

IP over ATM 4 2 2

PPP 22 12 10

PPPoE 10 5 5

•

See show columns.

show pppoe interface

•

Use to display summary information about the encapsulation type lockout parameters configured for PPPoE clients on a dynamic PPPoE subinterface column.

•

The following field descriptions and example include only the portion of the show pppoe interface command display relevant to lockout configuration for PPPoE clients.

For more information about using this command, see “show pppoe interface” on page 421

in “Configuring Point-to-Point Protocol over Ethernet” on page 371.

•

Field descriptions

•

Lockout Configuration (seconds)—Encapsulation type lockout settings for the PPPoE client associated with the dynamic PPPoE subinterface column

•

Min—Minimum lockout time, in seconds

•

Max—Maximum lockout time, in seconds

•

Total clients in active lockouts—Number of PPPoE clients currently undergoing dynamic encapsulation type lockout

•

Total clients in lockout grace period—Number of PPPoE clients currently in a lockout grace period; for more information about the lockout grace period, see

“Guidelines for Configuring Encapsulation Type Lockout for PPPoE sessions” on page 523

•

Example host1# show pppoe interface atm 3/0.101

. . .

Lockout Configuration (seconds): Min 5, Max 60

Total clients in active lockouts: 0

Total clients in lockout grace period: 0

Chapter 17: Configuring Dynamic Interfaces

•

See show pppoe interface.

show pppoe interface lockout-time

•

Use to display detailed information about the current encapsulation type lockout condition for each PPPoE client associated with a dynamic PPPoE subinterface column on a static PPPoE major interface.

•

Field descriptions

•

PPPoE interface—Specifier for the PPPoE interface

•

Lockout Configuration (seconds)—Encapsulation type lockout settings for the PPPoE client associated with the dynamic PPPoE subinterface column

•

Min—Minimum lockout time, in seconds

•

Max—Maximum lockout time, in seconds

•

Total clients in active lockouts—Number of PPPoE clients currently undergoing dynamic encapsulation type lockout

•

Total clients in lockout grace period—Number of PPPoE clients currently in a lockout grace period; for more information about the lockout grace period, see

“Guidelines for Configuring Encapsulation Type Lockout for PPPoE sessions” on page 523

•

Client Address—Source MAC address of the PPPoE client

NOTE: Because PPPoE sessions that contain the IWF-Session DSL Forum

VSA (26-154) use the same source MAC address of the DSLAM for all subscriber connections, multiple entries are displayed in the Client

Address field for the same MAC address if multiple IWF sessions contain the same MAC address.

•

Current—Current lockout time, in seconds; displays 0 (zero) if the PPPoE client is not undergoing lockout

•

Elapsed—Time elapsed into the lockout time, in seconds; displays 0 (zero) if the

PPPoE client is not undergoing lockout

•

Next—Lockout time that the router uses for the next lockout event, in seconds

•

Example host1# show pppoe interface atm 12/1/1.1.1 lockout-time

PPPoE interface atm 12/1/1.1

Lockout Configuration (seconds): Min 90, Max 120

Total clients in active lockout: 1

Total clients in lockout grace period: 0

Client Address Current Elapsed Next

-------------- ------- ------- ----

0090.1a42.527c 120 30 120

0090.1a42.527c 0 0 90

603

JunosE 11.3.x Link Layer Configuration Guide

•

See show pppoe interface lockout-time.

show pppoe subinterface

•

Use to display the source MAC address of a PPPoE client when a subscriber is connected to the router through an available PPPoE session. You can then specify this MAC

address in “pppoe clear lockout interface” on page 549 to clear the lockout condition

for the PPPoE client.

•

To display configuration, status, and statistics information, including the source MAC address of the PPPoE client, use the full keyword.

•

The following field descriptions and example include only the portion of the show pppoe subinterface command display relevant to the source MAC address for PPPoE

clients. For more information about using this command, see “show pppoe subinterface”

on page 428 in “Configuring Point-to-Point Protocol over Ethernet” on page 371.

•

Field descriptions

•

PPPoE subinterface—Specifier for the PPPoE subinterface

• source MAC address—MAC address of the PPPoE client associated with the dynamic

PPPoE subinterface column

•

Example host1# show pppoe subinterface full

...

PPPoE subinterface ATM 3/0.101 has source MAC address 0090.1a10.165e

...

•

See show pppoe subinterface.

show profile

•

Use to display information about profiles.

•

To display information about a specific profile, use the name keyword.

•

To display a list of profiles configured on the router, use the brief keyword.

•

Field descriptions

•

Profile—Name of the profile that is displayed

•

IP address—IP address and subnet mask of the interface, or none if the interface is unnumbered

•

Unnumbered interface—Specifier for the unnumbered interface, or none if the interface is numbered

•

Router—Name of the virtual router (VR) assigned to the profile; interfaces created by the profile are attached to this VR

•

Directed Broadcast—Enabled or disabled

•

ICMP Redirects—Enabled or disabled

•

Access Route Addition—Enabled or disabled

Chapter 17: Configuring Dynamic Interfaces

•

Network Address Translation—Enabled or disabled; domain location (inside or outside)

•

Source-Address Validation—Enabled or disabled

•

Ignore DF Bit—Enabled or disabled

•

Filter Option Packets—Router filters out packets with IP options; enabled or disabled

•

Administrative MTU—MTU size configured on the profile

•

TCP MSS value—Maximum segment size for TCP SYN packets traveling through the interface

•

Inactivity Timer—Inactivity timer setting; enabled or disabled

•

Route Map Name—Route map applied to the IP interface subscriber; enabled or disabled

•

Auto Detect—Router automatically detects packets that do not match any entries in the demultiplexer table; enabled or disabled

•

Auto Configure—Dynamic creation of subscriber interfaces on a primary IP interface; enabled or disabled

•

IGMP—Enabled or disabled

• static-groups—Displays address of any static groups configured for IGMP

•

Input policy—Name of input policy and whether statistics are enabled or disabled

•

Output policy—Name of output policy and whether statistics are enabled or disabled

•

PPP Keepalive—PPP keepalive period, in seconds

•

PPP Magic Number—Enabled or disabled

•

PPP Magic Number Mismatch—Indicates whether the router is configured to ignore the LCP peer magic number and retain the PPP connection when the peer has not negotiated an LCP magic number: ignore (ignore the peer magic number mismatch and retain the PPP connection), or reject (router terminates the PPP connection if it detects a peer magic number mismatch)

•

PPP Peer DNS Priority—Enabled or disabled

•

PPP Peer WINS Priority—Enabled or disabled

•

PPP Authentication—Type of authentication configured: PAP, CHAP, or none

•

PPP Authentication Router—Name of authentication virtual router

•

PPP Negotiate MRU—MRU configured for the profile

•

PPP Packet Log—Enabled or disabled

605

JunosE 11.3.x Link Layer Configuration Guide

606

•

PPP State Log—Enabled or disabled

•

PPP Chap Challenge Length—Minimum and maximum Chap Challenge length

•

PPP Passive Mode—Enabled or disabled

•

PPP Multilink—Enabled or disabled

•

PPP IPCP Netmask Option—Enabled or disabled

•

PPP IPCP Lockout Option—Enabled or disabled

•

PPP Max-negotiations IPCP—Maximum number of renegotiation attempts that the router accepts before terminating a PPP session

•

PPP AAA Profile—AAA profile associated with this PPP interface

•

PPP Multilink Fragmentation—Enabled or disabled

•

PPP Multilink Fragment Size—Multilink fragment size for this PPP interface

•

PPP Multilink Reassembly—Enabled or disabled

•

PPP Multilink Mrru—Multilink MRRU value for this PPP interface

•

PPP Hash Link Selection— Hash-based link selection for a PPP interface; enabled or disabled

•

PPP Initiate IP—Initiation of IPv4 over this PPP interface; enabled or disabled

•

PPP Initiate IPv6—Initiation of IPv6 over this PPP interface; enabled or disabled

•

PPP IPCP prompt-option dns—Prompts the CPE (Customer Premises Equipment) to negotiate the IPCP primary and secondary DNS options that are locally available with the broadband remote access server; enabled or disabled

•

PPPoE Max Sessions—Maximum number of PPPoE subinterfaces that can be on an interface

•

PPPoE Always-offer—Router offers to set up a session for the client, even if the router has insufficient resources to establish a session; enabled or disabled

•

PPPoE Remote-Circuit-Id—The router captures and processes a vendor-specific tag containing a remote circuit ID transmitted from a digital subscriber line access multiplexer (DSLAM); enabled or disabled

•

PPPoE Log PPPoeControlPacket—Enabled or disabled

•

PPPOE duplicate-protect—Enabled or disabled

•

PPPoE ACNAME—Access concentrator name

•

PPPoE URL—URL sent in PADM message to PPPoE clients

•

PPPoE MOTM—Message of the minute sent in the PADM message to PPPoE clients

Chapter 17: Configuring Dynamic Interfaces

•

PPPoE Service-Name Table—Name of the PPPoE service name table, if configured for the specified profile

•

ATM1483 Auto-configure—Whether autodetection of the specified upper-interface encapsulation type (bridged Ethernet, IP, PPP, or PPPoE) is enabled or disabled for a dynamic ATM 1483 subinterface

•

ATM1483 lockout (seconds)—Encapsulation type lockout setting for the specified upper-interface encapsulation type (bridged Ethernet, IP, PPP, or PPPoE) configured on a dynamic ATM 1483 subinterface

• range—Minimum lockout time–maximum lockout time, in seconds

• no lockout—Encapsulation type lockout is disabled

•

ATM1483 PVC circuit type—Encapsulation setting for the PVC configured on a dynamic ATM 1483 subinterface

• aal5autoconfig—Enables autodetection of the 1483 encapsulation (LLC/SNAP or VC multiplexed)

• aal5mux ip—VC-based multiplexed circuit for IP only

• aal5snap—LLC encapsulated circuit; the LLC/SNAP header precedes the protocol datagram

•

ATM1483 PVC service category—Service type setting for the PVC configured on a dynamic ATM 1483 subinterface: UBR (the default), UBR PCR, NRT-VBR, RT-VBR, or CBR

•

ATM1483 PVC Peak rate—Peak cell rate (PCR), in Kbps, for the PVC configured on a dynamic ATM 1483 subinterfaces

•

ATM1483 PVC Avg rate—Average rate, in Kbps, for the PVC configured on a dynamic

ATM 1483 subinterface; also referred to as sustained cell rate (SCR)

•

ATM1483 PVC Burst size—Length in cells of the burst for the PVC configured on a a dynamic ATM 1483 subinterface; also referred to as maximum burst size (MBS)

•

ATM1483 Description—Text description assigned to ATM 1483 subinterfaces that are created with this profile

•

ATM1483 Advisory Rx Speed—Configured receive speed, in Kbps, for the dynamic

ATM 1483 subinterface. The E Series LAC sends this value to the LNS in the RX

Connect-Speed AVP [38].

•

ATM1483 PVC OAM Administrative status—Status of OAM F5 loopback cell generation (for VC integrity) on a circuit created with this profile: enabled or disabled

•

ATM1483 PVC OAM Loopback frequency—Number of seconds between transmissions of OAM F5 end-to-end loopback cells on a circuit created with this profile

•

ATM1483 Ip Subscriber information—Subscriber login information for the specified dynamic interface type

607

JunosE 11.3.x Link Layer Configuration Guide

608

•

ATM1483 Profile—Name of the profile assigned to the specified upper-interface encapsulation type (bridged Ethernet, IP, PPP, or PPPoE); these profiles are referenced in the base profile for a dynamic ATM 1483 subinterface as nested profile assignments

•

VLAN Auto-configure—Whether auto detection of the specified upper-interface encapsulation type (IP or PPPoE) is enabled or disabled for a dynamic VLAN subinterface

•

VLAN Advisory Rx Speed—Configured advisory receive speed, in Kbps, for the dynamic

VLAN subinterface; the E Series LAC sends this value to the LNS in the RX

Connect-Speed AVP [38]

•

VLAN Advisory Tx Speed—Configured advisory speed, in Kbps, for the dynamic VLAN subinterface.

•

VLAN Description—Text description assigned to VLAN subinterfaces that are created with this profile

•

VLAN Profile—Name of the profile assigned to the specified upper-interface encapsulation type (IP or PPPoE); these profiles are referenced in the base profile for a dynamic VLAN subinterface as nested profile assignments

•

VLAN Service Profile—Service profile name for a VLAN

•

VLAN Svlan Ethertype—Ethertype that the packet must use this to create the dynamic

VLAN subinterface

•

Bridged Ethernet Mtu—MTU size configured for a dynamic bridged Ethernet interface

•

Bridged Ethernet Service Profile—Name of the IP service profile associated with the interface profile for this dynamic bridged Ethernet interface

•

IPv6 http redirect Url—Url to which a subscriber’s initial web browser session is redirected.

•

IPv6 Unnumbered interface—Name of interface without a specific address

•

IPv6 Router—Router name or default

•

IPv6 Src-Addr Validation—Source-Address Validation; enabled or disabled

•

IPv6 Administrative MTU—MTU size

•

IPv6 ND Enabled—State of the Neighbor Discovery; enabled or disabled

•

IPv6 ND ManagedConfig—State of the Neighbor Discovery router advertisement managed flag; enabled or disabled

•

IPv6 ND OtherConfig—State of the Neighbor Discovery router advertisement other config flag; enabled or disabled

•

IPv6 ND SuppressRa—Status IPv6 router advertisement suppression; enabled or disabled

Chapter 17: Configuring Dynamic Interfaces

•

IPv6 ND RaInterval—Interval (in seconds) of the Neighbor Discovery router advertisement

•

IPv6 ND RaLifeTime—Lifetime (in seconds) of the Neighbor Discovery router advertisement

•

IPv6 ND ReachableTime—Amount of time (in milliseconds) that the neighbor is expected to remain reachable

•

IPv6 ND RaPrefix—Configured prefixes for Neighbor Discovery router advertisement

•

IPv6 ND ValidLifetime—Amount of time (in seconds) that the router advertises the

IPv6 prefix as valid

•

IPv6 ND PreferredLifetime—Amount of time (in seconds) that the router advertises the specified IPv6 prefix as preferred

•

IPv6 ND PrefixOnLink—State of the on-link flag; enabled or disabled

•

IPv6 ND PrefixAutoConfig—State of the use the specified prefix for IPv6 autoconfiguration; enabled or disabled

•

Example 1—Displays configuration information for a profile assigned to a dynamic interface host1# show profile name pppoe

PPP Keepalive : 30

PPP Magic Number : enabled

PPP Magic Number Mismatch :reject

PPP Peer DNS Priority : disabled

PPP Peer WINS Priority : disabled

PPP Authentication :

PPP Authentication Router :

PPP Negotiate MRU : (use lower layer MRU)

PPP Packet Log : disabled

PPP State Log : disabled

PPP Chap Challenge Length : 16 - 32

PPP Passive Mode : disabled

PPP Multilink : disabled

PPP IPCP Netmask Option : disabled

PPP IPCP Lockout Option : disabled

PPP IPCP Lockout : disabled

PPP AAA Profile :

PPP Multilink Fragmentation : disabled

PPP Multilink Fragment Size : (use MTU)

PPP Multilink Reassembly : disabled

PPP Multilink Mrru : (use MRU)

PPP Hash Link Selection : disabled

PPP Initiate IP : disabled

PPP Initiate IPv6 : disabled

PPP Max-negotiations LCP : 30

PPP Max-negotiations IPCP : 30

PPP Max-negotiations IPv6CP : 30

PPP IPCP prompt-option DNS :enabled

PPP Client Username :

PPP Client Password :

PPP Client Authentication :

PPP Client Ip Address : 0.0.0.0

609

JunosE 11.3.x Link Layer Configuration Guide

610

PPP Client Primary Dns Address : 0.0.0.0

PPP Client Secondary Dns Address : 0.0.0.0

PPP Client Primary Wins Address : 0.0.0.0

PPP Client Secondary Wins Address : 0.0.0.0

•

Example 2—Displays configuration information for a base profile assigned to a dynamic

ATM 1483 subinterface host1# show profile name atm1483BaseProfile

ATM1483 Auto-configure ip : disabled

ATM1483 Auto-configure bridgedEthernet : disabled

ATM1483 Auto-configure ppp : enabled

ATM1483 lockout (seconds) ppp : range : 1-300

ATM1483 Auto-configure pppoe : enabled

ATM1483 lockout (seconds) pppoe : range : 1-300

ATM1483 PVC circuit type : aal5autoconfig

ATM1483 PVC service category : Nrt-Vbr

ATM1483 PVC Peak rate : 10000, Avg rate : 2000, Burst size : 500

ATM1483 Description : VC_atm1483

ATM1483 Advisory Rx Speed : 2000000000

ATM1483 PVC OAM Administrative status: enabled

ATM1483 PVC OAM Loopback frequency: 30

ATM1483 Ip Subscriber information:

user : elaine

domain : jpeterman.com

password : putty

ATM1483 IP Profile : none assigned

ATM1483 Bridged Ethernet Profile : none assigned

ATM1483 PPP Profile : none assigned

ATM1483 PPPoE Profile : pppoeProfile

•

Example 3—Displays configuration information for a base profile assigned to a dynamic

VLAN subinterface host1# show profile name vlanProfile

VLAN Auto-configure ip : enabled

VLAN Auto-configure pppoe : enabled

VLAN Svlan Ethertype : auto-configure

VLAN Advisory Rx Speed : 100 Kbps

VLAN Advisory Tx Speed : 2500 Kbps

VLAN Description : testing

VLAN IP Profile : ipProfile

VLAN PPPoE Profile : pppoeProfile

VLAN Service Profile : none assigned

Bridged Ethernet Mtu : 1971

Bridged Ethernet Service Profile : eastServiceProfile

•

Example 4—Displays profile configuration information related to IPv6 Neighbor

Discovery router advertisement host1# show profile name ipv6Profile

IPv6 Unnumbered interface : loopback 0

IPv6 Router : default

IPv6 Src-Addr Validation : Disabled

IPv6 Administrative MTU : 0

IPv6 ND Enabled : Enabled

IPv6 ND ManagedConfig : Disabled

Chapter 17: Configuring Dynamic Interfaces

IPv6 ND OtherConfig : Enabled

IPv6 ND SuppressRa : Disabled

IPv6 ND RaInterval : 50

IPv6 ND RaLifeTime : 1800

IPv6 ND ReachableTime : 0

IPv6 ND RaPrefix : 1234::/64

IPv6 ND ValidLifetime : 60

IPv6 ND PreferredLifetime : 60

IPv6 ND PrefixOnLink : Enabled

IPv6 ND PrefixAutoConfig : Enabled

IPv6 http redirect Url : http://www.google.com

•

See show profile.

show vlan subinterface

•

Use to display configuration and status information for a specified VLAN subinterface or for all VLAN subinterfaces configured on the router.

•

Use the summary keyword to display only the counts of all VLAN subinterfaces and

VLAN major interfaces configured on the router.

•

Use the vlan or svlan keywords to display information about specific VLAN IDs or

S-VLAN IDs.

•

Field descriptions

•

Interface—Type and specifier of the VLAN subinterface

•

Status—Status of the VLAN subinterface: up, down, dormant, lowerLayerDown, absent

•

MTU—Maximum allowable size (in bytes) of the MTU for the VLAN subinterface

•

Svlan Id—S-VLAN ID value, if configured

•

Vlan Id—VLAN ID value for the VLAN subinterface

•

Ethertype—S-VLAN Ethertype value, if configured

•

Type—Type of VLAN subinterface

•

Static—VLAN or S-VLAN subinterface was configured statically

•

Dynamic—VLAN or S-VLAN subinterface was configured dynamically

•

Auto configure interface(s)—Types of dynamic upper interfaces configured with the auto-configure command: IP or PPPoE

•

Detected dynamic interface—Type of dynamic upper interface detected during autoconfiguration: IP, PPPoE, or (if no packet has been received) none

•

Interface types in lockout—Encapsulation types currently experiencing lockout: IP,

PPPoE, or none

•

Lockout state (seconds)—Settings of encapsulation type lockout for the upper-layer encapsulation type indicated

611

JunosE 11.3.x Link Layer Configuration Guide

•

Min—Minimum lockout time, in seconds

•

Max—Maximum lockout time, in seconds

•

Current—Current lockout time, in seconds; displays 0 (zero) if lockout is not occurring

•

Elapsed—Time elapsed into the lockout time, in seconds; displays 0 (zero) if lockout is not occurring

•

Next—Lockout time for the router to use for the next lockout event, in seconds

•

In—Analysis of inbound traffic on this interface

•

Bytes—Number of bytes received on the VLAN or S-VLAN subinterface

•

Packets—Sum of all unicast, broadcast, and multicast packets received on the

VLAN or S-VLAN subinterface

•

Multicast—Number of multicast packets received on the VLAN or S-VLAN subinterface

•

Broadcast—Number of broadcast packets received on the VLAN or S-VLAN subinterface

•

Errors—Total number of errors in all received packets; some packets might contain more than one error

•

Discards—Total number of discarded incoming packets

•

Out—Analysis of outbound traffic on this interface

•

Bytes—Number of bytes sent on the VLAN or S-VLAN subinterface

•

Packets—Number of packets sent on the VLAN or S-VLAN subinterface

•

Multicast—Number of multicast packets received on the VLAN or S-VLAN subinterface

•

Broadcast—Number of broadcast packets received on the VLAN or S-VLAN subinterface

•

Errors—Total number of errors in all transmitted packets; some packets might contain more than one error

•

Discards—Total number of discarded outgoing packets

•

ARP Statistics—Analysis of ARP traffic on this interface; In fields are for traffic received on the interface and Out fields are for traffic sent on the interface

•

ARP requests—Number of ARP requests

•

ARP responses—Number of ARP responses

Chapter 17: Configuring Dynamic Interfaces

•

Errors—Total number of errors in all ARP packets

•

Discards—Total number of discarded ARP packets

•

Total VLAN interfaces—Total numbers of VLAN subinterfaces and VLAN major interfaces configured on the router; only this field appears when you specify the summary keyword

•

Example 1—Displays full status and configuration information for all VLAN subinterfaces configured on the router host1# show vlan subinterface

Interface Status MTU Svlan Id Vlan Id Ethertype Type

--------------------- ---------- ---- -------- -------- --------- -------

ATM 3/0.1.2 Up 1522 ---- 11 ---- Static

ATM 3/0.1.3 Up 1522 ---- 12 ---- Static

ATM 3/1.1.1 Up 1522 ---- 13 ---- Static

ATM 3/1.1.2 Up 1522 ---- 14 ---- Static

ATM 3/2.1.1 Down 1526 4 255 0x9100 Static

FastEthernet 4/5.1 Up 1522 ---- 1 ---- Dynamic

6 vlan subinterfaces found

•

Example 2—Displays full status and configuration information for the specified VLAN subinterface host1# show vlan subinterface fastEthernet 4/5.1

Interface Status MTU Svlan Id Vlan Id Ethertype Type

---------------------- -------- ---- -------- -------- --------- -------

FastEthernet 4/5.1 Up 522 ---- 1 ---- Dynamic

1 vlan subinterface found

•

Example 3—Displays full status and configuration information for the specified S-VLAN

ID host1# show vlan subinterface svlan id 100 53

Interface Status MTU Svlan Id Vlan Id Ethertype Type

---------------------- -------- ---- -------- -------- --------- -------

FastEthernet 0/0.1 Up 1526 100 53 0x9100 Static

FastEthernet 4/6.1 Up 1526 100 53 0x9100 Dynamic

2 vlan subinterfaces found

•

Example 4—Displays full status and configuration information for the specified dynamic

VLAN subinterface host1# show vlan subinterface fastEthernet 4/6.1000053

Interface Status MTU Svlan Id Vlan Id Ethertype Type

------------------------- ------ ---- -------- -------- --------- -------

FastEthernet 4/6.1000053 Up 1526 100 53 0x9100 Dynamic

Auto configure interface(s) : IP PPPoE

Detected dynamic interface : PPPoE

Interface types in lockout : none

Lockout state (seconds) : Min Max Current Elapsed Next

------------------------------- --- --- ------- ------- ----

IP 1 300 0 0 1

PPPoE 1 300 0 0 1

In: Bytes 1040, Packets 15

Multicast 0, Broadcast 1

Errors 0, Discards 0

Out: Bytes 984, Packets 15

613

JunosE 11.3.x Link Layer Configuration Guide

Multicast 0, Broadcast 1

Errors 0, Discards 0

ARP Statistics:

In: ARP requests 0, ARP responses 0

Errors 0, Discards 0

Out: ARP requests 0, ARP responses 0

Errors 0, Discards 0

•

See show vlan subinterface.

Troubleshooting PPP and PPPoE Dynamic Interfaces

You can issue the profile-reassign command to help you use PPP and PPPoE packet–logging capabilities to debug and troubleshoot PPP and PPPoE dynamic interfaces. To use the profile-reassign command, you must access Privileged Exec mode at privilege level 5 or higher.

The profile-reassign command enables you to reassign the profile currently assigned to the specified encapsulation type for the specified ATM 1483 subinterface. In effect, you swap the currently assigned nondebug profile for a debug profile that has identical attributes with the addition of one or more PPP or PPPoE packet–logging attributes enabled.

To troubleshoot PPP and PPPoE dynamic interfaces:

Create a debug profile that includes the same attributes as an existing nondebug profile, with the addition of one or more PPP or PPPoE packet–logging attributes enabled.

Observe the following guidelines when you create the debug profile:

•

Because PPP and PPPoE packet logging is performed at log severity 7 (debug priority), configure a destination such as the console to log severity level 7 and issue the log here command to enable packet capture using the debug profile you created.

• Before you reassign the debug profile to the ATM 1483 subinterface, make sure that the number of PPP dynamic interfaces has not already exceeded the maximum number of aggregate dynamic and static PPP interfaces for which you can log PPP packets. For more information about this and other system maximums, see JunosE

Release Notes, Appendix A, System Maximums.

For details about creating and using profiles, see “Configuring a Dynamic Interface from a Profile” on page 559.

Access Privileged Exec mode at privilege level 5 or higher.

host1>enable 5

Password: ********* host1#

Chapter 17: Configuring Dynamic Interfaces

enable

NOTE: The router prompts you for a password only if you have configured a password to control access to Privileged Exec mode. For details about setting passwords to access various command privilege levels, see chapter

Passwords and Security in JunosE System Basics Configuration Guide.

From Privileged Exec mode, issue the profile-reassign command to replace the nondebug profile currently assigned to the specified encapsulation type for the specified ATM 1483 interface with the debug profile created in Step 1.

You must specify one of the following encapsulation types to which the debug profile applies: ppp, pppoe, or any. You can use the any encapsulation type if neither the ppp encapsulation type nor the pppoe encapsulation type has an existing profile assignment. For example: host1#profile-reassign atm 2/0.101 ppp pppLogConfig

NOTE: Issuing the profile-reassign command causes the router to tear down any dynamic interfaces that exist above the ATM 1483 subinterface.

After the profile is reassigned, the router restores the interfaces based on the necessary client reconnections. If the ATM 1483 subinterface is currently shut down, issuing the profile-reassign command does not reestablish the interface connection.

(Optional) Use the appropriate show command to verify the profile reassignment.

For example: host1#show atm subinterface atm 2/0.101

When you reassign a debug profile to an ATM 1483 subinterface, the reassignment is stored in NVS and persists after a reboot. If you issue the show atm subinterface or show configuration command after the profile is reassigned, these commands display the new profile assignment.

(Optional) To restore the initial (nondebug) profile assignment after you troubleshoot the dynamic interface, issue the profile-reassign command again using the name of the nondebug profile. For example: host1#profile-reassign atm 2/0.101 ppp pppConfig

•

Use to move from User Exec to Privileged Exec mode.

•

In Privileged Exec mode, you can access all other user interface modes. From here you can configure, monitor, and manage all aspects of the router.

•

Optionally, you can specify one of the following privilege levels; the default level is 10.

•

0—The user can execute the help, enable, disable, and exit commands.

•

1—The user can execute commands in User Exec mode plus commands at level 0.

615

JunosE 11.3.x Link Layer Configuration Guide

profile-reassign

•

5—The user can execute Privileged Exec show commands plus the commands at levels 1 and 0.

•

10—The user can execute all commands except support commands, which may be provided by Juniper Networks Customer Service.

•

15—The user can execute support commands.

•

Set a password for this mode by using either the enable password or the enable secret command in Global Configuration mode. Doing so protects the router from any unauthorized use.

•

After a password is set, anyone trying to use Privileged Exec mode is prompted to provide the password.

•

Example host1>enable 5

Password:******* host1#

•

There is no no version.

•

See enable.

•

Use to reassign the profile currently assigned to the specified encapsulation type for the specified ATM 1483 interface. For troubleshooting purposes, use the profile-reassign command to swap the currently assigned profile for one that has PPP or PPPoE packet–logging attributes enabled.

•

This command is available from Privileged Exec mode at privilege level 5 or higher.

•

Specify one of the following keywords:

• ppp—Specifies a PPP encapsulation type to which the profile applies

• pppoe—Specifies a PPPoE encapsulation type to which the profile applies

• any—Specifies any autoconfigured encapsulation that does not have a specific profile assignment; valid only if neither the ppp encapsulation type nor the pppoe encapsulation type has an existing profile assignment

•

Specify a profile name of up to 80 alphanumeric characters.

•

Example 1—Facilitates debugging for the ppp encapsulation type by swapping profile pppConfig for profile pppLogConfig, which includes PPP packet–logging attributes host1#profile-reassign atm 2/0.101 ppp pppLogConfig

WARNING: Execution of this command will cause all dynamic interfaces over atm 2/0.101 to be torn-down.

Proceed with profile reassignment? [confirm] yes

Profile pppConfig replaced by profile pppLogConfig for ppp.

•

Example 2—Facilitates debugging for the any encapsulation type by swapping profile anyConfig for profile anyLogConfig, which includes both PPP and PPPoE packet–logging attributes

Chapter 17: Configuring Dynamic Interfaces host1#profile-reassign atm 3/0.101 any anyLogConfig

WARNING: Execution of this command will cause all dynamic interfaces over atm 3/0.101 to be torn-down.

Proceed with profile reassignment? [confirm] yes

Profile anyConfig replaced by profile anyLogConfig for any.

•

Example 3—Restores the initial (nondebug) profile assignment for the ppp encapsulation type shown in Example 1. Assuming that PPP packet logging is not configured in profile pppConfig, this command also disables logging for the interface host1#profile-reassign atm 2/0.101 ppp pppConfig

WARNING: Execution of this command will cause all dynamic interfaces over atm 2/0.101 to be torn-down.

Proceed with profile reassignment? [confirm] yes

Profile pppLogConfig replaced by profile pppConfig for ppp.

•

There is no no version.

•

See profile-reassign.

617

JunosE 11.3.x Link Layer Configuration Guide