5

If link with subscribers, containing about 12000 clients, goes down. One aggregated ethernet containing two links which goes to two different FPC's. All clients try to authorize on JuniperMX with the help of DHCP Discover messages. This is eoip network.

In case of authorizing too many clients (with the help of RADIUS), FPC (MPC 3D 16x 10GE) CPU goes about 100% and stops processing other clients authorizations.

Is this normal and I should limit clients per FPC or I have some misconfigurations?

juniper-1> show version 
Model: mx960
Junos: 16.1R6-S3.1
JUNOS OS Kernel 64-bit  [20180310.ba55661_builder_stable_10]
...

And licences are used less than exists in the system:

juniper-1> show system license     
License usage: 
                          Licenses     Licenses    Licenses
  Feature name                used    installed      needed 
  ...
  scale-subscriber           39614       128000           0
  ...

All four LAG's has identical configuration and composed from 2 10G links. Every link connected to different card (xe-0/2/3, xe-1/0/1):

juniper-1> show configuration interfaces ae3
flexible-vlan-tagging;
auto-configure {
    vlan-ranges {
        dynamic-profile vlan-autosense-profile {
            accept dhcp-v4;
            ranges {
                3-4094;
            }
        }
    }
}
encapsulation flexible-ethernet-services;
aggregated-ether-options {
    load-balance {
        no-adaptive;
    }
    minimum-links 1;
    link-speed 10g;
    lacp {
        active;
        periodic fast;
    }
}

Allowed vlans are configured from downstream switch. Every vlan allowed only once on one of four links. I.e. VLAN100 allowed on ae1 only.

juniper-1> show configuration dynamic-profiles dhcp-local-server-profile 
interfaces {
    demux0 {
        unit "$junos-interface-unit" {
            no-traps;
            proxy-arp;
            demux-options {
                underlying-interface "$junos-underlying-interface";
            }
            targeted-distribution;
            family inet {
                demux-source {
                    $junos-subscriber-ip-address;
                }
                inactive: filter {
                    input "$junos-input-filter";
                    output "$junos-output-filter";
                }
                unnumbered-address lo0.0;
            }
        }
    }
}

Every client has from three to five activated services. Autosence profile configuration:

juniper-1> show configuration dynamic-profiles vlan-autosense-profile   
interfaces {
    "$junos-interface-ifd-name" {
        unit "$junos-interface-unit" {
            demux-source inet;
            proxy-arp;
            vlan-id "$junos-vlan-id";
            family inet {
                unnumbered-address lo0.0;
            }
        }
    }
}

juniper-1> show configuration system configuration-database    
max-db-size 314572800;

Allowed users with public IP's has four services (speed limits - local networks, global networks, state networks). If client has private IP it has additional service - "redirect gateway to NAT server". Finally all clients which has denied network access has service for "denying".

  • 2
    Can you post the output of "show version" and "show system license"? It would also help to have your AE/LAG config as well as the related VLAN and DHCP dynamic-profiles. Lastly, are both line cards "MPC 3D 16x 10GE"? This will help me determine if it's a simple or nuanced problem. – Jordan Head Feb 5 at 14:35
  • @JordanHead DHCP server - all processing on the same box. DHCP server local profile has targeted-distribution - set dynamic-profiles dhcp-local-server-profile interfaces demux0 unit "$junos-interface-unit" targeted-distribution. – Tomato Feb 5 at 20:17
  • Thank you, this helps! Some additional follow-up, if I may. Was this working before/did anything change when this stopped working? Does the MX stop processing DHCP packets entirely (does "show dhcp server statistics" increment?) or is it that subscribers authenticate and get an IP, but the MX is not building the sessions in the forwarding table? Can you also add the configuration for the "vlan-autosense-profile" and for "show configuration system configuration-database"? I'm also still unclear on if both FPCs that participate in each LAG are the same model or not. – Jordan Head Feb 6 at 13:08
  • Ah, yes, sorry, both FPC is the same MPC 3D 16x 10GE and LAG connected to separate FPC's. This problem was from the start using a router. Btw router also handles all BGP external connections. – Tomato Feb 6 at 14:48
  • 1
    JUNOS has functionality built into the subscriber management software to automatically throttle subscriber connection setup rate (assuming the requests are being received), but that happens after DDoS protection. Can you check if you're tripping DDoS violations (you can use "show ddos-protection protocols violations" to see current, and "show ddos-protection protocols statistics" to see older violations. Depending on how your downstream switch is configured, it's possible the DHCP requests are being flooded and tripping the thresholds. – Jordan Head Feb 6 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.