Dan Fisher | Fluidata <DanFisher@fluidata.co.uk> writes:
Hi,
We are using Cisco and Juniper devices as LAC's to terminate DSL sessions before sending on via L2TP to customer LNS's. We allow our customers to use radius Attribute 67 via our radius servers to specify the tunnel-server-endpoint for their sessions.
We have been using Cisco LACs predominantly over the last couple of years but now have a need to move to Juniper kit for scalability constraints. The issue I have is how we allow customers to specify groups of radius reply values for failover/load balancing across their LNS's.
Below is an example showing what we are sending back to our Cisco LAC's (please note the use of += as the operator for the "second" group in the list):
Sending Access-Accept of id 216 to 192.168.1.1 port 50075 Tunnel-Client-Auth-Id:1 = "xxxxxxxx" Tunnel-Type:1 = L2TP Tunnel-Password:1 = "yyyyyyy" Tunnel-Server-Endpoint:1 = "1.2.3.4" Tunnel-Preference:1 = 10 Tunnel-Client-Auth-Id:2 += " xxxxxxxx" Tunnel-Type:2 += L2TP Tunnel-Password:2 += " yyyyyyy" Tunnel-Server-Endpoint:2 += "1.2.3.5" Tunnel-Preference:2 += 10
The issue I have is that the Juniper device will not process the += operator based results, so in order to have the same functionailty, the radius result would have to look like below (please note there is no += anymore):
Sending Access-Accept of id 217 to 192.168.1.1 port 50075 Tunnel-Client-Auth-Id:1 = "xxxxxxxx" Tunnel-Type:1 = L2TP Tunnel-Password:1 = "yyyyyyy" Tunnel-Server-Endpoint:1 = "1.2.3.4" Tunnel-Preference:1 = 10 Tunnel-Client-Auth-Id:2 = " xxxxxxxx" Tunnel-Type:2 = L2TP Tunnel-Password:2 = " yyyyyyy" Tunnel-Server-Endpoint:2 = "1.2.3.5" Tunnel-Preference:2 = 10
Huh? The NAS won't see the operator and therefore cannot process it in any way. It is parsed and interpreted by the radius server, which will convert the above entries into a list of attribute codes and values. But those two configurations will look very different on the wire. The difference is that the last one will be collapsed to Tunnel-Client-Auth-Id:1 = "xxxxxxxx" Tunnel-Type:1 = L2TP Tunnel-Password:1 = "yyyyyyy" Tunnel-Server-Endpoint:1 = "1.2.3.4" Tunnel-Preference:1 = 10
I have a case open with Juniper to resolve the +=/= issue, but I haven't got an ETA of the fix yet, and I cannot just wait for it.
What kind of Juniper? ERX or MX makes a lot of difference... You may also want to experiment with the ERX-Tunnel-Password VSA instead of Tunnel-Password. FWIW, we have been using ERXes as LACs for ages, and have not had any problems using a failover configuration similar to your first example. Bjørn