Operations
Subscriber Management
The following commands are served by subscriber daemon and are applicable for all kinds of subscribers like PPPoE, L2TP or IPoE.
Subscribers
The term subscriber describes an access user or session from a higher level decoupled from underlying protocols like PPPoE or IPoE. Subscribers in RBFS can be managed locally or remote via RADIUS. Each subscriber is uniquely identified by a 64bit number called subscriber-id.
Subscriber States
A good starting point for troubleshooting subscriber services is to verify the status of the subscriber sessions. The state ESTABLISHED means that the session is fully operational.
supervisor@leaf1: op> show subscriber Subscriber-Id Interface VLAN Type State 72339069014638600 ifp-0/0/1 1:1 PPPoE ESTABLISHED 72339069014638601 ifp-0/0/1 1:2 PPPoE ESTABLISHED 72339069014638602 ifp-0/0/1 1:3 PPPoE ESTABLISHED 72339069014638603 ifp-0/0/3 2000:7 L2TP ESTABLISHED
Alternative use show subscriber detail which shows further details like username, Agent-Remote-Id (aka Line-Id)
or Agent-Circuit-Id if screen width is large enough to print all those information.
The meaning of the subscriber state is shown in the following table and diagram.
| State | Description |
|---|---|
INIT |
Initial subscriber state. |
AUTHENTICATING |
Authenticate the subscriber using the configured method. |
ADDRESS ALLOCATION |
Allocate (RADIUS or pool) and validate (DAD) addresses. |
TUNNEL SETUP |
Setup tunnel resources (L2TP or L2X). |
IFL SETUP |
Create subscriber IFL with corresponding QoS resources. |
FULL |
Wait for subscriber to be in forwarding state. Inform underlying protocols (PPPoED or IPoED) to continue with session setup. |
ACCOUNTING |
Start subscriber accounting and wait for response. |
ESTABLISHED |
The subscriber becomes ESTABLISHED after response to RADIUS Accounting-Request-Start if RADIUS accounting is enabled otherwise immediately after FULL. |
TERMINATING |
The subscriber remains in this state until all resources are freed and accounting stopped. This means that subscriber remain in this state until response to RADIUS Accounting-Request-Stop if RADIUS accounting is enabled. |
For each subscriber a set of commands is available showing detailed information.
supervisor@leaf1: op> show subscriber 72339069014638594
<cr>
access-line Subscriber access line information
accounting Subscriber accounting information
acl Subscriber ACL information (filter)
detail Detailed subscriber information
qos Subscriber QoS information
user@switch: op> show subscriber 72339069014638594 detail
Subscriber-Id: 72339069014638594
Type: PPPoE
State: ESTABLISHED
Created: Fri Sep 18 20:50:02 GMT +0000 2020
Interface: ifl-0/0/1
Outer VLAN: 128
Inner VLAN: 7
Client MAC: fe:08:e8:ea:1d:32
Server MAC: 7a:52:4a:01:00:01
IFL: ppp-0/0/1/72339069014638594
Username: 1122334455#123456789#0001@t-online.de
Agent-Remote-Id: DEU.DTAG.1337
Agent-Circuit-Id: 0.0.0.0/0.0.0.0 eth 1337
Access-Profile: access-profile1
AAA-Profile: aaa-profile1
Session-Timeout: 30000
Idle-Timeout: 120
IPv4:
Instance: default
Address: 198.51.100.116/255.255.255.255
Address Active: True
Primary DNS: 198.51.100.213
Secondary DNS: 198.51.100.54
IPv6:
Instance: default
RA Prefix: 2001:db8:0:400::/32
RA Prefix Active: True
Delegated Prefix (DHCPv6): 2001:db8:0:269::/56
Delegated Prefix Active: False
Primary DNS: 2001:db8:0:92::
Secondary DNS: 2001:db8:0:174::
Accounting:
Session-Id: 72339069014638594:1600462202
Start-Time: 2020-09-18T20:50:02.738306+0000
Interims Interval: 30 seconds
Subscriber Termination Codes
The following command shows the reasons why subscribers are terminated for the last 24 hours and up to 4000 subscribers.
supervisor@leaf1: op> show subscriber history Subscriber-Id Timestamp Terminate Code 72339069014638594 Fri Oct 16 20:17:33 GMT +0000 2020 Accounting-Request-On Wait 72339069014638595 Fri Oct 16 20:32:19 GMT +0000 2020 PPPoE LCP Terminate Request Received
Subscriber Count
To view a summary of PPPoE, L2TP, IPoE, and L2BSA subscribers in the Setup, Established, and Terminating state, use the "show subscriber count" command. This command provides information per interface and a total summary based on subscriber type.
supervisor@leaf1: op> show subscriber count
Total Setup Established Terminating
Summary 18000 0 18000 0
PPPoE 18000 0 18000 0
L2TP 0 0 0 0
IPoE 0 0 0 0
L2BSA 0 0 0 0
ifp-0/1/30 6000 0 6000 0
PPPoE 6000 0 6000 0
L2TP 0 0 0 0
IPoE 0 0 0 0
L2BSA 0 0 0 0
ifp-0/1/32 6000 0 6000 0
PPPoE 6000 0 6000 0
L2TP 0 0 0 0
IPoE 0 0 0 0
L2BSA 0 0 0 0
ifp-0/1/33 6000 0 6000 0
PPPoE 6000 0 6000 0
L2TP 0 0 0 0
IPoE 0 0 0 0
L2BSA 0 0 0 0
supervisor@leaf1: op>
RADIUS
RADIUS Profile
The following command shows the status of all RADIUS profiles.
supervisor@leaf1: op> show radius profile
RADIUS Profile: radius-default
NAS-Identifier: BNG
NAS-Port-Type: Ethernet
Authentication:
Algorithm: ROUND-ROBIN
Server:
radius-server-1
radius-server-2
Accounting:
State: UP
Stop on Reject: True
Stop on Failure: True
Backup: True
Algorithm: ROUND-ROBIN
Server:
radius-server-1
radius-server-2
This meaning of the accounting state is explained in the table below.
| Code | State | Description |
|---|---|---|
0x00 |
DISABLED |
Change profile accounting state from DISABLED to ACTIVE if at least one server referenced is found with accounting enabled. |
0x01 |
ACTIVE |
Server referenced by RADIUS profile but no response received |
0x02 |
STARTING |
Send accounting-on and wait for response. |
0x05 |
UP |
Change profile accounting state to UP if at least one referenced accounting server is UP. |
The profile state becomes immediately ACTIVE if at least one of the referenced accounting servers can be found in RADIUS server table with accounting enabled. Otherwise the profile keeps DISABLED.
If RADIUS Accounting-On is enabled, the profile state becomes STARTING before UP. It is not permitted to send any accounting request start, interim or stop related to a profile in this state. It is also not permitted to send authentication requests if accounting-on-wait is configured in addition. The state becomes UP if at least one server in the accounting server list is in a state UP or higher (UNREACHABLE, DOWN, TESTING, DEAD).
A new profile added which references existing used RADIUS servers must not trigger a RADIUS Accounting-On request if at least one of the referenced servers is in a state of UP or higher.
RADIUS Server
The following command shows the status of all RADIUS servers.
supervisor@leaf1: op> show radius server RADIUS Server Address Authentication State Accounting State radius-server-1 198.51.100.64 ACTIVE UP radius-server-2 198.51.100.163 ACTIVE ACTIVE radius-server-3 198.51.100.104 ACTIVE ACTIVE
This meaning of those states is explained in the table and diagram below.
| Code | State | Description |
|---|---|---|
0x00 |
DISABLED |
RADIUS authentication (authentication state) or accounting (accounting state) is disabled or server not referenced by profile. |
0x01 |
ACTIVE |
Server referenced by RADIUS profile but no valid response received. |
0x02 |
STARTING |
This state is valid for accounting (accounting state) only during accounting-on is sending (wait for accounting-on response). |
0x03 |
STOPPING |
This state is valid for accounting (accounting state) only during accounting-off is sending (wait for accounting-off response). |
0x04 |
FAILED |
This state is valid for accounting (accounting state) only if accounting-on/off timeout occurs. |
0x05 |
UP |
Valid RADIUS response received |
0x06 |
UNREACHABLE |
No response received/timeout but server is still usable. |
0x07 |
DOWN |
Server is down but can be selected. |
0x08 |
TESTING |
Send a request to test if server is back again. The server will not be selected for another request in this state (use a single request to check if server is back again). |
0x09 |
DEAD |
Server is down and should not be selected. |
For each server dedicated detailed information are displayed with the following commands.
supervisor@leaf1: op> show radius server radius-server-1
RADIUS Server: radius-server-1
Address: 198.51.100.64
Source: 198.51.100.200
Rate: 600 PPS
Rate Tokens: 600
Dropped: 0
Authentication:
State: ACTIVE
State Changed: Fri Oct 16 20:17:27 GMT +0000 2020
Port: 1812
Retry: 3
Timeout: 5
Outstanding: 100
Statistics:
Request Sent: 0
Request Retry: 0
Request Timeout: 0
Accept Received: 0
Reject Received: 0
Dropped: 0
Accounting:
State: UP
State Changed: Fri Oct 16 20:18:27 GMT +0000 2020
Port: 1813
Retry: 10
Timeout: 30
Outstanding: 100
Statistics:
Request Sent: 1
Request Retry: 2
Request Timeout: 0
Response Received: 1
Dropped: 0
CoA:
Port: 3799
Statistics:
Request Received: 0
Dropped: 0
PPPoE
The following commands are applicable for PPPoE sessions only.
For PPPoE sessions the state should be ESTABLISHED if local terminated or TUNNELLED for L2TPv2 tunnelled sessions.
supervisor@rtbrick: op> show pppoe session Subscriber-Id Interface VLAN MAC State 72339069014638604 ifp-0/0/1 1:1 00:04:0e:00:00:01 ESTABLISHED 72339069014638601 ifp-0/0/1 1:2 00:04:0e:00:00:02 ESTABLISHED 72339069014638602 ifp-0/0/1 1:3 00:04:0e:00:00:03 ESTABLISHED 72339069014638603 ifp-0/0/3 2000:7 52:54:00:57:c8:29 TUNNELLED
Alternative use show pppoe session detail which shows further details like username, Agent-Remote-Id (aka Line-Id) or Agent-Circuit-Id if screen
width is large enough to print all those information.
| State | Description |
|---|---|
LINKING |
PPP LCP setup. |
AUTHENTICATING |
PPP authentication (PAP or CHAP). |
NETWORKING |
PPP IPCP (IPv4) and IP6CP (IPv6) setup. |
ESTABLISHED |
The PPPoE session becomes established if at least one NCP (IPCP or IP6CP) is established (state OPEN). |
TUNNELLED |
This state indicates that a PPPoE session is tunnelled via L2TPv2. |
TERMINATING |
PPP session teardown. |
TERMINATED |
PPPoE session terminated. |
If PPPoE session remain in state TERMINATED, the subscriber state should be checked. Typically this happens if RADIUS Accounting-Request-Stop is still pending.
Further details per PPPoE session can be shown with the following commands.
supervisor@rtbrick: op> show pppoe session 72339069014638648 <cr> detail Detailed session information statistics Protocol statistics
The detail command shows the states of the session and all sub-protocols with extensive information and negotiated parameters.
user@switch: op> show pppoe session 72339069014638648 detail
Subscriber-Id: 72339069014638648
State: ESTABLISHED
Uptime: Tue Nov 17 11:46:43 GMT +0000 2020 (0:00:21.979775)
Interface: ifp-0/0/3
Outer VLAN: 10
Inner VLAN: 7
Client MAC: 52:54:00:57:c8:29
Server MAC: 7a:52:4a:c0:00:03
Session-Id: 55
Host-Unique: 00000001
Agent-Remote-Id: DEU.RTBRICK.1
Agent-Circuit-Id: 0.0.0.0/0.0.0.0 eth 1
Access-Profile: pppoe-dual
AAA-Profile: aaa-default
PPP LCP:
State: OPENED
Negotiated Protocols: CHAP, IPCP, IP6CP
Negotiated Parameters: MRU, AUTH, MAGIC
Magic Number: 1079931229 Peer: 3432759752
MRU: 1492 Peer: 1492
MTU: 1492 Profile: __default_pppoe__
Echo Interval: 30 seconds
CHAP Authentication:
State: COMPLETED
Username: user1@rtbrick.com
PPP IPCP:
State: OPENED
Instance: default
IP Address: 198.51.100.200 Peer: 198.51.100.72
Primary DNS: 198.51.100.88
Secondary DNS: 198.51.100.54
PPP IP6CP:
State: OPENED
Instance: default
Interface Identifier: c5f6:1dbd:8cc1:bea9
Peer Interface Identifier: 5054:00ff:fe57:c829
IPv6:
RA Interval: 60 seconds
RA Prefix: 2001:db8:0:246::/32
Delegated Prefix (DHCPv6): 2001:db8:0:9::/32 Assigned: True
Primary DNS: 2001:db8:0:114::
Secondary DNS: 2001:db8:0:115::
Control Traffic Statistics:
Ingress: 15 packets 1059 bytes
Egress: 16 packets 1475 bytes
Session statistics are available global and per session.
supervisor@rtbrick: op> show pppoe session statistics supervisor@rtbrick: op> show pppoe session 72339069014638601 statistics
The PPPoE discovery statistics are helpful if session setup fails in initial PPPoE tunnel setup before actual PPP negotiation is starting.
supervisor@rtbrick: op> show pppoe discovery packets Packet Received Sent PADI 17 0 PADO 0 17 PADR 17 0 PADS 0 17 PADT 1 13 supervisor@rtbrick: op> show pppoe discovery errors PADI Drop No Config : 0 PADI Drop Session Protection : 0 PADI Drop Session Limit : 0 PADI Drop Dup Session : 0 PADI Drop Interface Down : 0 PADR Drop No Config : 0 PADR Drop Wrong MAC : 0 PADR Drop Interface Down : 0 PADR Drop Session Limit : 0 PADR Drop Session Protection : 0 PADR Drop Bad Cookie : 0 PADR Drop Bad Session : 0 PADR Drop Dup Session : 0 PADR Drop No mapping Id : 0 PADT Drop No Session : 0 PADT Drop Wrong MAC : 0 PADX Interface Get Failure : 0
If PPPoE session protection is enabled in access configuration profile,
short lived or failed sessions will be logged in the PPPoE session protection
table (local.pppoe.session.protection).
Every session not established for at least 60 seconds per default is considered as failed or short lived session. This will block new sessions on this IFP and VLAN’s for one second per default which increase exponential with any further failed session until the max time of per default 300 seconds is reached. The interval is reset after 900 seconds without failed sessions.
The PPPoE session protection table include also last subscriber-id and terminate code which indicates the reason for session failures.
supervisor@rtbrick: op> show pppoe discovery protection Interface VLAN Status Attempts Last Terminate Code ifp-0/0/1 1:1 OK 1 PPPoE LCP Terminate Request Received ifp-0/0/1 1:2 OK 1 PPPoE LCP Terminate Request Received ifp-0/0/1 1:3 OK 1 PPPoE LCP Terminate Request Received
If status OK indicates that new session are accepted where BLOCKED means that sessions will be rejected.
L2TP
The following commands are applicable for L2TP only.
For L2TPv2 tunnelled PPPoE sessions the global unique subscriber-id can be used to get information about the L2TP session.
supervisor@rtbrick: op> show l2tp subscriber 72339069014638621
Subscriber-Id: 72339069014638621
State: ESTABLISHED
Local TID: 45880
Local SID: 39503
Peer TID: 1
Peer SID: 1
Call Serial Number: 10
TX Speed: 10007000 bps
RX Speed: 1007000 bps
CSUN: disabled
The following command gives a good overview over the corresponding tunnels.
supervisor@leaf1: op> show l2tp tunnel sessions Role Local TID Peer TID State Preference Sessions Established Peer Name LAC 2022 1 ESTABLISHED 10000 1 1 LNS3 LAC 3274 1 ESTABLISHED 10000 1 1 LNS8 LAC 14690 1 ESTABLISHED 10000 1 1 LNS6 LAC 29489 1 ESTABLISHED 10000 1 1 LNS9 LAC 33323 1 ESTABLISHED 10000 1 1 LNS4 LAC 35657 1 ESTABLISHED 10000 1 1 LNS10 LAC 37975 1 ESTABLISHED 10000 1 1 LNS1 LAC 45880 1 ESTABLISHED 10000 1 1 LNS7 LAC 46559 1 ESTABLISHED 10000 1 1 LNS2 LAC 58154 1 ESTABLISHED 10000 1 1 LNS5
Detailed information per tunnel are available via show l2tp tunnel <TID> detail.
L2TP tunnel statistics are available global and per tunnel.
supervisor@leaf1: op> show l2tp tunnel statistics supervisor@leaf1: op> show l2tp tunnel 37975 statistics
L2TP Result and Disconnect Codes
The received result (RFC2661) and disconnect (RFC3145) code and message from CDN and StopCCN will be stored similar to the subscriber terminate history table for 24 hours and up to 1000 records.
supervisor@leaf1: op> show l2tp tunnel history
Sequence Local TID Peer TID Timestamp Terminate Code
1 34209 0 Wed Jul 28 13:02:35 GMT +0000 2021 Admin Request
2 39860 1 Wed Jul 28 13:02:35 GMT +0000 2021 Admin Request
3 39860 2 Wed Jul 28 13:02:54 GMT +0000 2021 Admin Request
4 39860 3 Wed Jul 28 13:04:29 GMT +0000 2021 StopCCN Received (Requester is being shut down)
5 39860 1 Wed Jul 28 13:06:19 GMT +0000 2021 StopCCN Received (Requester is being shut down)
supervisor@leaf1: op> show l2tp tunnel history 4
Local TID: 39860 Peer TID: 3
Terminate Code: StopCCN Received
Timestamp: Wed Jul 28 13:04:29 GMT +0000 2021
Local Address: 198.51.100.102
Peer Address: 198.51.100.133
Peer Name: LNS1
Tunnel-Client-Auth-ID: BNG
Tunnel-Server-Auth-ID: LNS1
Result Code: Requester is being shut down
supervisor@leaf1: op> show l2tp session history
Subscriber-Id Local TID Local SID Terminate Code
72339069014638614 39860 5597 Clear Session
72339069014638615 39860 5208 Clear Session
72339069014638623 39860 29626 Clear Session
72339069014638624 39860 42480 L2TP Tunnel Down
72339069014638625 39860 34417 L2TP Tunnel Down
72339069014638626 39860 20229 L2TP Tunnel Down
The show subscriber history <subscriber-id> command will
also return L2TP details if found for the corresponding subscriber.
supervisor@leaf1: op> show subscriber history 72339069014638703
Subscriber-Id: 72339069014638703
Terminate Code: L2TP CDN Request
Timestamp: Wed Jul 28 13:06:18 GMT +0000 2021
Interface: ifl-0/0/1
Outer VLAN: 1000
Inner VLAN: 2002
Client MAC: 02:00:00:00:00:04
Username: blaster@l2tp.de
Agent-Remote-Id: DEU.RTBRICK.2
Agent-Circuit-Id: 0.0.0.0/0.0.0.0 eth 0:2
Accounting-Session-Id: 72339069014638703:1627477569
L2TP Disconnect Cause:
Code: Normal disconnection (LCP terminate-request)
Protocol: 0
Direction: Peer
Message: N/A
IPoE
The following commands are applicable for IPoE subscribers only.
supervisor@leaf1: op> show ipoe subscriber detail Subscriber-Id Interface VLAN MAC State DHCPv4 DHCPv6 216454257090494465 ifl-0/0/1 8:1 02:00:00:00:00:01 ESTABLISHED Bound Bound 216454257090494466 ifl-0/0/1 8:2 02:00:00:00:00:02 ESTABLISHED Bound Bound 216454257090494467 ifl-0/0/1 8:3 02:00:00:00:00:03 ESTABLISHED Bound Bound 216454257090494468 ifl-0/0/1 8:4 02:00:00:00:00:04 ESTABLISHED Bound Bound
Further details per subscriber can be shown with the following command.
supervisor@leaf1: op> show ipoe subscriber 216454257090494465 detail
Subscriber-Id: 216454257090494465
State: ESTABLISHED
Uptime: Mon Jun 14 15:46:15 GMT +0000 2021 (0:02:19.421591)
Interface: ifl-0/0/1
Outer VLAN: 8
Inner VLAN: 1
Client MAC: 02:00:00:00:00:01
Gateway Interface: lo-0/0/0/1
Gateway Instance: default
Gateway IPv4: 198.51.100.200/255.255.255.255
Gateway MAC: 7a:52:4a:c0:00:01
Agent-Remote-Id: DEU.RTBRICK.1
Agent-Circuit-Id: 0.0.0.0/0.0.0.0 eth 0:1
DHCPv4:
Mode: Server
State: Bound
Address: 198.51.100.202/255.255.255.255
Lease Created: Mon Jun 14 15:46:15 GMT +0000 2021 (0:02:19.427443)
Lease Time: 300 seconds
Lease Expire: 161 seconds
DHCPv6:
Mode: Server
State: Bound
Client DUID: 00030001020000000001
Server DUID: 0003001b78524afffec00001
IA_NA:
Address: 2001:db8:0:96
IAID: 1181407340
Active: True
IA_PD:
Prefix: 2001:db8:0:333/32
IAID: 4095128883
Active: True
Lease Created: Mon Jun 14 15:46:15 GMT +0000 2021 (0:02:19.428676)
Lease Time (Lifetime): 14400 seconds
Lease Expire: 14261 seconds
Preferred Lifetime: 1800 seconds
Local Address Pools
| Rather than using recommended IP addresses for technical documents, the document shows actual IP pool ranges. |
The usage of local address pools can be monitored using the show subscriber pool commands as shown below.
supervisor@switch: op> show subscriber pool summary
Pool Name AFI Usage Range
pool-A IPv4 256/256 10.0.1.0 - 10.0.1.255
pool-B IPv4 2/256 10.0.2.0 - 10.0.2.255
pool-C IPv4 0/256 10.0.3.0 - 10.0.3.255
pool-D IPv4 0/256 10.0.4.0 - 10.0.4.255
supervisor@switch: op> show subscriber pool ipv4 pool-A
Pool Name: pool-A
AFI: IPv4
Usage: 256/256
Range: 10.0.1.0 - 10.0.1.255
Next: pool-B
supervisor@switch: op> show subscriber pool ipv4 pool-B
Pool Name: pool-B
AFI: IPv4
Usage: 2/256
Range: 10.0.2.0 - 10.0.2.255
Next: pool-C
supervisor@switch: op> show subscriber pool ipv4 pool-B allocation
Subscriber-Id Timestamp Address/Prefix
72339069014638598 Wed Sep 15 09:02:15 GMT +0000 2021 10.0.2.0
72339069014638602 Wed Sep 15 09:02:15 GMT +0000 2021 10.0.2.1