[j-nsp] Placing a subscriber in a VRF

Thomas Salmen tsalmen at orcon.net.nz
Sun May 7 15:41:44 EDT 2006


I can't seem to figure out how to place a subscriber in a VRF using radius
under junose. I've tried sending back:

ERX-Virtual-Router-Name = "default:test_vrf"


ERX-Virtual-Router-Name = ":test_vrf"

and even just:

ERX-Virtual-Router-Name = "test_vrf"

but connection attempts just hang and eventually time out (L2TP connections;
the ERX I'm testing against is an LNS). Testing the login from the CLI seems
okay, and so does testing when not attempting to specify a VRF:

nct_erx01#test aaa ppp vpn at test.orcon.net.nz vpn123
************ user attributes *************
Authentication Grant
    idle Timeout - 0
    session Timeout - 0
    accounting Timeout - 1800
    Client IP Address -
    Client IP Netmask -
    Client IPv6 Interface Id - 0:0:0:0
    primary DNS IP Address -
    secondary DNS IP Address -
    primary IPv6 DNS IP Address - ::
    secondary IPv6 DNS IP Address - ::
    primary WINS IP Address -
    secondary WINS IP Address -
    SA Validate - disabled 
    IGMP - disabled 
    Ignore-DF-Bit - disabled 
    MLD Version - MLD Version not set 
    IGMP Version - IGMP Version not set 
    router context - default:test_vrf
    local interface - <NULL>
    IGMP Access Group Name - <NULL>
    IGMP Access Source Group Name - <NULL>
    IGMP OIF Map Name - <NULL>
    IP Multicast Admission Bandwidth Limit - not set
    IPv6 router context - No Router
    IPv6 local interface - <NULL>
    MLD Access Group Name - <NULL>
    MLD Access Source Group Name - <NULL>
    MLD OIF Map Name - <NULL>
    IPv6 Multicast Admission Bandwidth Limit - not set
IPv6 inhibited
************ no ppp attributes *************
pausing 5 seconds before disconnecting test user, vpn at test.orcon.net.nz

Can anyone offer any further guidance? I can't find any working radius
examples in the junose docs or anywhere else, and I can't see any other
radius attributes that look appropriate. The VPN config seems okay;
statically adding interfaces to it works fine. 


More information about the juniper-nsp mailing list