| Next revision | Previous revision |
| en:dpi:bras_bng:bras_l2_vlan:bras_l2_vlan_dhcp:dual_dhcp [2025/11/25 14:46] – created elena.krasnobryzh | en:dpi:bras_bng:bras_l2_vlan:bras_l2_vlan_dhcp:dual_dhcp [2026/06/03 12:00] (current) – elena.krasnobryzh |
|---|
| ======DHCP Dual Proxy====== | ======DHCP Dual Proxy====== |
| |
| **DHCP Dual Proxy** (hereinafter — Dual DHCP) — in this mode, fastDPI operates as a single authorization point, requesting all parameters from the RADIUS server via fastPCRF in a single request. The mode is optimized for Dual Stack (IPv4/IPv6) subscribers, but also fully supports IPv4-only and IPv6-only subscribers. | ===== General information ===== |
| | |
| | **DHCP Dual Proxy** (hereinafter referred to as Dual DHCP) is a mode in which fastDPI acts as a single authorization point, requesting all parameters from the RADIUS server through fastPCRF in a single request. The mode is optimized for Dual Stack (IPv4/IPv6) subscribers, while also fully supporting IPv4-only and IPv6-only subscribers. |
| |
| Activation: | Activation: |
| <code>bras_dhcp_mode=3</code> | <code> |
| | bras_dhcp_mode=3 |
| | </code> |
| | |
| | Dual DHCP is designed for networks where authorization and session management need to be simplified. Unlike DHCP proxy mode (''[[en:dpi:bras_bng:bras_l2_vlan:bras_l2_vlan_dhcp:bras_l2_vlan_dhcp_proxy|bras_dhcp_mode=2]]''), a single accounting session is created for Dual Stack subscribers, and the RADIUS server returns addresses and settings for both protocols in a single Access-Accept response. If only one address type (IPv4 only or IPv6 only) is received in the authorization response, it means that only that protocol is available to the subscriber, and a DHCP NAK will be returned in response to DHCPv4 or DHCPv6 requests for the unavailable protocol. |
| | |
| | The mode uses the existing configuration options from ''[[en:dpi:bras_bng:bras_l2_vlan:bras_l2_vlan_dhcp:bras_l2_vlan_dhcp_proxy|bras_dhcp_mode=2]]'', such as ''bras_dhcp_check_secondary_keys'', ''bras_dhcp_ratelimit'', ''bras_dhcp_ratelimit_ban'', and ''bras_dhcp_qinq_only''. |
| | |
| | ===== Session-Timeout and Lease-Time ===== |
| | |
| | In Dual DHCP mode, the session lifetime (''session-timeout'') and the address lease time (''lease-time'') are clearly separated. ''Session-timeout'', specified by the RADIUS Session-Timeout attribute, defines the validity period of the authorization parameters and cannot be less than 600 seconds (1 day by default). |
| | |
| | ''Lease-time'' defines how long the subscriber is allowed to use the assigned IP address, that is, how long before the subscriber must send a DHCP request to renew the lease. In Dual DHCP mode, it is critical that ''Session-timeout'' is at least four times greater than ''Lease-time''. If this condition is not met, ''Lease-time'' is automatically set to 1/4 of ''Session-timeout''. |
| | |
| | ''Lease-time'' is determined using the following priority order: |
| | * ''DHCP-IP-Address-Lease-Time'' attribute; |
| | * ''VasExperts-DHCP-Option-Num'' attribute specifying DHCP option 51; |
| | * DHCP option 51 if the address is allocated from a ''Framed-Pool''. |
| | |
| | If ''Lease-time'' is not specified by any of the methods above, it is assumed to be equal to 1/16 of ''Session-timeout''. |
| | |
| | Minimum values: |
| | * ''Session-timeout'' — 600 seconds; |
| | * ''Lease-time'' — 60 seconds. |
| | |
| | ===== Reauthorization ===== |
| | |
| | The subscriber periodically sends lease renewal requests (DHCP Renew). During the ''session-timeout'' period, SSG automatically confirms these requests without contacting the RADIUS server. CoA Disconnect is used for forced reauthorization: after it is received, the next DHCP Renew triggers a new authorization request to the RADIUS server. |
| |
| Dual DHCP is intended for networks where authorization and session management need to be simplified. Unlike the DHCP proxy mode (''[[en:dpi:bras_bng:bras_l2_vlan:bras_l2_vlan_dhcp:bras_l2_vlan_dhcp_proxy|bras_dhcp_mode=2]]''), a single accounting session is created for Dual Stack subscribers, and the RADIUS server returns addresses and settings for both protocols in one Access-Accept. If the authorization response contains only one type of address (IPv4 or IPv6 only), it means that only this protocol is available for the subscriber, and the subscriber will receive DHCP NAK for any DHCPv4 or DHCPv6 request attempts. | If a new IP address is assigned to the subscriber, SSG responds to the Renew request with a NAK packet, triggering the standard address acquisition procedure without additional authorization: the subscriber sends DHCP Discover → SSG responds with DHCP Offer (offering a new address) → the subscriber sends DHCP Request → SSG responds with DHCP ACK. |
| |
| This mode uses existing configuration options from ''[[en:dpi:bras_bng:bras_l2_vlan:bras_l2_vlan_dhcp:bras_l2_vlan_dhcp_proxy|bras_dhcp_mode=2]]'', such as ''bras_dhcp_check_secondary_keys'', ''bras_dhcp_ratelimit'', ''bras_dhcp_ratelimit_ban'' and ''bras_dhcp_qinq_only''. | No additional authorization request is performed during this process because SSG has already received all subscriber properties and responds to DHCP requests on its own throughout the ''session-timeout'' period. |
| |
| In Dual DHCP mode, session lifetime (''session-timeout'') and address lease time (''lease-time'') are strictly separated. ''Session-timeout'', defined via the RADIUS attribute Session-Timeout, determines the period during which authorization parameters are valid and cannot be less than 600 seconds (default is 1 day). ''Lease-time'' defines how long an IP address is leased to the subscriber — i.e., after what time the subscriber must send a DHCP Renew to extend the lease. ''Lease-time'' is calculated automatically, cannot be set in the RADIUS reply, and normally equals 300 seconds (5 minutes), but not less than 60 seconds. | ===== IPv6 address assignment ===== |
| |
| The subscriber regularly sends lease renewal requests (DHCP Renew). During the ''session-timeout'' period, SSG automatically acknowledges them without contacting the RADIUS server. CoA Disconnect is used for forced re-authorization: after it is received, the next DHCP Renew triggers a new RADIUS authorization request. If the subscriber receives a new IP address during this process, SSG replies with DHCP NAK to the Renew, which triggers the standard DHCP address acquisition process without additional authorization: subscriber sends DHCP-Discover → SSG replies with DHCP-Offer → subscriber sends DHCP-Request → SSG replies with DHCP-ACK. No additional authorization will occur — SSG already received the subscriber properties and continues to serve DHCP requests during the ''session-timeout''. | In the authorization response, the RADIUS server provides IPv6 addresses using the ''Framed-IPv6-Address'', ''Framed-IPv6-Prefix'', and ''Delegated-IPv6-Prefix'' attributes. ''Delegated-IPv6-Prefix'' is communicated to the subscriber, while ''Framed-IPv6-Address'' and ''Framed-IPv6-Prefix'' are mutually exclusive: either a single address (''Framed-IPv6-Address'') or an entire subnet (''Framed-IPv6-Prefix'') is assigned. SSG allocates subnet addresses independently in response to subscriber requests as follows: |
| |
| In the authorization reply, RADIUS returns IPv6 addresses in the ''Framed-IPv6-Address'', ''Framed-IPv6-Prefix'', and ''Delegated-IPv6-Prefix'' attributes. ''Delegated-IPv6-Prefix'' is passed to the subscriber, while ''Framed-IPv6-Address'' and ''Framed-IPv6-Prefix'' are mutually exclusive — either a single address (''Framed-IPv6-Address'') or an entire prefix (''Framed-IPv6-Prefix'') is returned. Subnet addresses are allocated by SSG as follows: | * If the ''Framed-IPv6-Address'' attribute is present in the response, only the specified IPv6 address is assigned to the subscriber. If the ''Framed-IPv6-Prefix'' attribute is also present, it is ignored. All subsequent subscriber requests for additional IPv6 addresses will be rejected. |
| * If ''Framed-IPv6-Address'' is present, the subscriber receives exactly this IPv6 address. If ''Framed-IPv6-Prefix'' is also present, it is ignored. Any further requests for additional IPv6 addresses will be rejected. | * If the ''Framed-IPv6-Prefix'' attribute is present and ''Framed-IPv6-Address'' is absent, SSG will satisfy subscriber requests for multiple addresses from that pool. |
| * If ''Framed-IPv6-Prefix'' is present and ''Framed-IPv6-Address'' is absent, SSG will allocate multiple IPv6 addresses from this prefix upon subscriber requests. | |
| |
| SSG supports pools defined by ''Framed-Pool'' (IPv4) and ''Framed-IPv6-Pool'' (IPv6). A mixed configuration is possible — for example, a static IPv4 address via ''Framed-Address'' and an IPv6 address from a pool. If both a specific address and a pool are present in the RADIUS reply, the address has priority and the pool is ignored. | ===== Address pool operation ===== |
| |
| When using pools, fastPCRF requests addresses from internal or external DHCP servers and must follow the lease protocol. For this reason, SSG differentiates two lease times: ''lease-time'' for the **subscriber** (fixed 300 seconds) and ''lease-time'' for the **pool**, which is provided by the DHCP server and should correspond to ''session-timeout''. This helps reduce load by avoiding excessive pool renewals. | To obtain addresses, SSG supports pools specified by the ''Framed-Pool'' (IPv4) and ''Framed-IPv6-Pool'' (IPv6) attributes. Mixed configurations are supported; for example, an explicit IPv4 address can be assigned using ''Framed-Address'' while an IPv6 address is obtained from a pool. If both a specific address and a pool are specified in the RADIUS response, the address takes precedence and the pool is ignored. |
| |
| | When working with pools, fastPCRF requests addresses from local or external DHCP servers and must comply with the lease protocol. For this purpose, SSG distinguishes between two lease times: ''lease-time'' for the **subscriber** and ''lease-time'' for the **pool**, which is defined by the DHCP server and should be comparable to ''session-timeout''. This makes it possible to renew pool leases less frequently and avoid unnecessary load. |
