1

We have a VoD server that's directly connected to Juniper MX104 BNG. Juniper MX104 is also acting as a BRAS. Right now if any user accesses that VoD server, all the incoming and outgoing traffic is added to the user's accounting details, however, for this particular VoD server we don't want the data to be added in user's monthly allowed quota. Please advice how can we get this mechanism.

Thank you.

Improve this question

2 Answers 2

Reset to default
1

You need to use Juniper's Per-Service Session Accounting.

In a nutshell, this involves defining services using a firewall filter, applying those services per subscriber, then the MX will send independent RADIUS Accounting updates for each service per subscriber.

In your case, you would define a VoD or generic unmetered service, with an firewall filter matching your VoD server and any other local resources you don't wish to count, and then apply this as a service to each of your subscribers.

You would then have a second service applied covering all other traffic, and this is what you would actually count.

NE StackExchange discourages linking to other sites due to link rot, but search for "Junos Configuring Per-Service Session Accounting"

Improve this answer
4
  • Okay so I searched for "Junos Configuring Per-Service Session Accounting" and checked it. It surely looks like what I wanted, provided we can "activate" more than one service for a subscriber. However, I searched for the service but couldn't found anything. By per-service, are we talking about Class of Service or something else? @Benjamin Dale
    – myst3ri0us
    Apr 5, 2017 at 17:02
  • No - per-service is simply Juniper's way of providing different access to a particular subscriber based on source/destination address/port. Your example is a good one - an ISP may have their own internal VoD which they provide unmetered, whereas an OTT player like Netflix is metered. These would be examples of services.
    – Benjamin Dale
    Apr 5, 2017 at 22:31
  • Yes, would you redirect me, yet again, in the right direction where i can get some example of service configuration? All i could find is CoS. Though it's clear that that service is something else, and is activated through VSA 26-65, I didn't find anything that explains how do you configure those service. I already have a firewall filter in place which differentiates between the VoD traffic and others but the packets are still counted.
    – myst3ri0us
    Apr 6, 2017 at 3:29
  • I found something which is exactly what I wanted to do here: Service Session Profiles but this is for an older Junos. Can you guide me or send me some link maybe where I can find about creating service profiles on newer JunOS? @Benjamin Dale
    – myst3ri0us
    Apr 7, 2017 at 8:33
1

OK, so here's what I did to achieve no accounting from particular server:

  1. Configure Service Profile INTERNET and SERVER.
  2. Enable Service-Accounting only for INTERNET. MX will initiate per service accounting for INTERNET.
  3. Preference is given for SERVER. So any traffic matching VoD server will not be accounted. Firewall configuration has service-filter-hit term which means that traffic matching this Service-Profile should bypass Service-Profile INTERNET.

Configuration

  mist@ERX-MX960-II-RE0# show dynamic-profiles PPPOE-PROFILE
    interfaces {

    pp0 {
        unit "$junos-interface-unit" {
            no-traps;
            ppp-options {
                pap;
            }
            pppoe-options {
                underlying-interface "$junos-underlying-interface";
                server;
            }
            targeted-distribution;
            keepalives interval 30;
            family inet {
                unnumbered-address lo0.0;
            }
        }
    }
}


mist@ERX-MX960-II-RE0# show dynamic-profiles SERVER          
variables {
    SERVER-IN uid;
    SERVER-OUT uid;
}
interfaces {
    pp0 {
        unit "$junos-interface-unit" {
            family inet {
                filter {
                    input "$SERVER-IN" precedence 60;
                    output "$SERVER-OUT" precedence 60;
                }
            }
        }
    }
}
firewall {
    family inet {
        filter "$SERVER-IN" {
            interface-specific;
            term 1 {
                from {
                    destination-address {
                        200.200.200.2/32;
                    }
                }
                then {
                    service-accounting;
                    service-filter-hit;
                    accept;
                }
            }
        }
        filter "$SERVER-OUT" {
            interface-specific;
            term 1 {
                from {
                    source-address {
                        200.200.200.2/32;
                    }
                }
                then {
                    service-accounting;
                    service-filter-hit;
                    accept;
                }
            }
        }
   }
}



mist@ERX-MX960-II-RE0# show dynamic-profiles INTERNET 
variables {
    Bandwidth-IN mandatory;
    Burst-IN mandatory;
    Bandwidth-OUT mandatory;
    Burst-OUT mandatory;
    INTERNET-IN uid;
    INTERNET-OUT uid;
    Policer-IN uid;
    Policer-OUT uid;
}
interfaces {
    pp0 {
        unit "$junos-interface-unit" {
            family inet {
                filter {
                    input "$INTERNET-IN" precedence 100;
                    output "$INTERNET-OUT" precedence 100;
                }
            }
        }
    }
}
firewall {
    family inet {
        filter "$INTERNET-IN" {
            interface-specific;
            term 1 {
                from {
                    service-filter-hit;
                }
                then accept;
            }
            term 2 {
                then {
                    policer "$Policer-IN";
                    service-accounting;
                    accept;
                }
            }
        }
        filter "$INTERNET-OUT" {
            interface-specific;
            term 1 {
                from {
                    service-filter-hit;
                }
                then accept;
            }
            term 2 {
                then {
                    policer "$Policer-OUT";
                    service-accounting;
                    accept;
                }
            }
        }
    }
    policer "$Policer-IN" {
        filter-specific;
        if-exceeding {
            bandwidth-limit "$Bandwidth-IN";
            burst-size-limit "$Burst-IN";
        }
        then discard;
    }                                  
    policer "$Policer-OUT" {
        filter-specific;
        if-exceeding {
            bandwidth-limit "$Bandwidth-OUT";
            burst-size-limit "$Burst-OUT";
        }
        then discard;
    }
}

Flow is below

  1. Subscriber login to MX.
  2. Radius will return attribute to activate both Server and INTERNET profile.
  3. MX will activate both the Services i.e Server and Internet.
  4. Accounting is activated only for service-profile INTERNET.
  5. Preference is given for Server than Internet [Lower preference more preferred]. So traffic matching the Service-Profile Server will bypass Internet Server using service-filter-hit term.

RADIUS ATTRIBUTES

Cleartext-Password := "mist123"
ERX-Service-Activate:1 += "SERVER",
ERX-Service-Activate:2 += "INTERNET(100M,1M,200M,2M)",
ERX-Service-Acct-Interval:2 += "600",
ERX-Service-Statistics:2 += time-volume

Below is the testing

mist@ERX-MX960-II-RE0# run show subscribers extensive
Type: VLAN
Logical System: default
Routing Instance: default
Interface: demux0.3221225495
Interface type: Dynamic
Underlying Interface: ae0
Dynamic Profile Name: DYN-VLAN-Q-IN-Q-AE-PROFILE
Dynamic Profile Version: 1
State: Active
Session ID: 100034
PFE Flow ID: 40068
Stacked VLAN Id: 0x8100.1
VLAN Id: 0x8100.1
Login Time: 2017-04-11 13:21:34 IST

Type: PPPoE
User Name: [email protected]
IP Address: 10.200.0.12
IP Netmask: 255.255.255.255
Domain name server inet: 8.8.4.4
Domain name server inet6: 2001:4860:4860::8844
Logical System: default
Routing Instance: default
Interface: pp0.3221225496
Interface type: Dynamic
Underlying Interface: demux0.3221225495
Dynamic Profile Name: PPPOE-PROFILE
Dynamic Profile Version: 1
MAC Address: 00:16:01:00:00:01
State: Active
Radius Accounting ID: 100035
Session ID: 100035
PFE Flow ID: 40069
Stacked VLAN Id: 1
VLAN Id: 1
Login Time: 2017-04-11 13:21:34 IST
Service Sessions: 2
IP Address Pool: ipv4-pool
Accounting interval: 600

   Service Session ID: 100036
   Service Session Name: SERVER
   Service Session Version: 1
   State: Active
   Family: inet
   IPv4 Input Filter Name: SERVER-IN_UID4030-pp0.3221225496-in
   IPv4 Output Filter Name: SERVER-OUT_UID4031-pp0.3221225496-out
   Service Activation time: 2017-04-11 13:21:35 IST
   Dynamic configuration:
     SERVER-IN: SERVER-IN_UID4030
     SERVER-OUT: SERVER-OUT_UID4031

   Service Session ID: 100037
   Service Session Name: INTERNET
   Service Session Version: 1
   State: Active
   Family: inet
   IPv4 Input Filter Name: INTERNET-IN_UID4033-pp0.3221225496-in
   IPv4 Output Filter Name: INTERNET-OUT_UID4035-pp0.3221225496-out
   Service Activation time: 2017-04-11 13:21:35 IST
   Accounting interval service: 600
   Dynamic configuration:
     Bandwidth-IN: 100M
     Bandwidth-OUT: 200M
     Burst-IN: 1M                       
     Burst-OUT: 2M
     INTERNET-IN: INTERNET-IN_UID4033
     INTERNET-OUT: INTERNET-OUT_UID4035
     Policer-IN: Policer-IN_UID4032
     Policer-OUT: Policer-OUT_UID4034


mist@ERX-MX960-II-RE0# run show interfaces pp0.3221225496 extensive
  Logical interface pp0.3221225496 (Index 536910981) (SNMP ifIndex 200040069) (Generation 40042)
    Flags: Up Point-To-Point Encapsulation: PPPoE
    PPPoE:
      State: SessionUp, Session ID: 1,
      Session AC name: MX960, Remote MAC address: 00:16:01:00:00:01,
      Underlying interface: demux0.3221225495 (Index 536910980)
    Traffic statistics:
     Input  bytes  :             62560176
     Output bytes  :             63087314
     Input  packets:                82050
     Output packets:                82061
    Local statistics:
     Input  bytes  :                    0
     Output bytes  :                    0
     Input  packets:                    0
     Output packets:                    0
    Transit statistics:
     Input  bytes  :             62560176               107112 bps
     Output bytes  :             63087314                36288 bps
     Input  packets:                82050                   10 pps
     Output packets:                82061                   10 pps
  Keepalive settings: Interval 30 seconds, Up-count 3, Down-count 3
  LCP state: Opened
  NCP state: inet: Opened, inet6: Not-configured, iso: Not-configured, mpls: Not-configured
  CHAP state: Closed
  PAP state: Success
    Protocol inet, MTU: 1492, Generation: 0, Route table: 0
      Flags: Unnumbered
      Donor interface: lo0.0 (Index 322)
      Input Filters: SERVER-IN_UID4030-pp0.3221225496-in (60), INTERNET-IN_UID4033-pp0.3221225496-in (100)
      Output Filters: SERVER-OUT_UID4031-pp0.3221225496-out (60), INTERNET-OUT_UID4035-pp0.3221225496-out (100)
      Addresses, Flags: Is-Primary
        Destination: Unspecified, Local: 10.200.0.1, Broadcast: Unspecified, Generation: 0


mist@ERX-MX960-II-RE0# run show firewall

Filter: __default_bpdu_filter__                               


Filter: SERVER-IN_UID4030-pp0.3221225496-in                   
Counters:
Name                                                Bytes              Packets
__junos-dyn-service-counter                      60341436                78894

Filter: SERVER-OUT_UID4031-pp0.3221225496-out                 
Counters:
Name                                                Bytes              Packets
__junos-dyn-service-counter                      60848755                78905

Filter: INTERNET-IN_UID4033-pp0.3221225496-in                 
Counters:
Name                                                Bytes              Packets
__junos-dyn-service-counter                             0                    0
Policers:
Name                                                Bytes              Packets
Policer-IN_UID4032-pp0.3221225496-in                    0                    0

Filter: INTERNET-OUT_UID4035-pp0.3221225496-out               
 Counters:
Name                                                Bytes              Packets
__junos-dyn-service-counter                             0                    0
Policers:
Name                                                Bytes              Packets
Policer-OUT_UID4034-pp0.3221225496-out                    0                    0
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.