Differences

This shows you the differences between two versions of the page.

--- en:dpi:bras_bng:opt_bras_l2:ipv6:start [2023/08/28 13:33] – ↷ Page moved from en:dpi:dpi_options:opt_bras_l2:ipv6:start to en:dpi:bras_bng:opt_bras_l2:ipv6:start elena.krasnobryzh
+++ en:dpi:bras_bng:opt_bras_l2:ipv6:start [2023/10/13 13:39] (current) – removed elena.krasnobryzh
@@ Line 1: / Line 1: @@
-====== 8 IPv6 Support ======
-{{indexmenu_n>8}}
-L2 BRAS (BNG) supports allocating of stateful DHCPv6 IPv6 addresses. In this mode, IPv6-address is allocated to the subscriber with DHCPv6. Automated allocation of IPv6-addresses (SLAAC/stateless DHCPv6) is not supported.
-The concept of the work scheme looks like this:
-  - subscriber's CPE searches for the IPv6-router using ICMPv6. DPI announces itself as an IPv6-router. It specifies that DHCPv6 is needed in order to recieve an IPv6-address;
-  - CPE sends a DHCPv6-request to obtain an IPv6-address;
-  - DPI intercepts all DHCPv6 subscriber requests and processes them, in fact it is acting as a DHCPv6 server. If the DPI has no information on such subscriber or the session has expired, DHCPv6-request is transferred to Radius with PCRF;
-  - PCRF receives a response from Radius. Among other parameters, it contains subscriber's IPv6-prefix and PD-prefix (prefix delegation) if needed. Then the response is tranferred back to DPI;
-  - Having the data from PCRF, DPI sends a DHCPv6-response to the subscriber. DPI allocates one IPv6 address from the IPv6 prefix given to the subscriber, while the PD-prefix is transmitted to the subscriber completely. Despite that only one address is allocated from an IPv6-prefix, all IPv6 addresses of this prefix belong to this subscriber. Actually, the subscriber can request several IPv6-addresses, - they will all be issued from the IPv6 prefix provided.
-<note warning>It should be specially noted that the Radius should allocate a fixed-length IPv6 prefix to the subscriber. Prefix length is set by parameter  [[en:dpi:dpi_components:platform:dpi_ipv6:start|ipv6_subnetwork]], /64 is the default value. PD-prefix length also has to be equal ''ipv6_subnetwork''.</note>
-If the subscriber has both IPv6- and PD-prefix, then such subscriber must be marked as multi-bind. The reason is that such subcriber holds //**two**// IPv6-prefixes; Radius response should contain attribute ''VasExperts-Multi-IP-User=1''.
-=== Enabling IPv6 BRAS/BNG ===
-IPv6 BRAS/BNG mode is enabled automatically, if there is a setting in //fastdpi.conf//
-<code bash>
-ipv6=1
-bras_enable=1
-</code>
-You can disable IPv6 BRAS by setting in //fastdpi.conf//:
-<code bash>
-bras_ipv6=0
-</code>
-The bras_ipv6 parameter can be turned off (''bras_ipv6=0'') without DPI restart.
-DHCPv6 request processing mode is enabled since IPv6 BRAS is enabled. You can disable DHCPv6 and ICMPv6 Router Solicitation by setting in //fastdpi.conf//
-<code bash>
-bras_dhcp6_mode=0
-</code>
-Additionally you can set the following parameters in //fastdpi.conf//:
-♦ ''bras_ipv6_link_local'' - link-local DPI address (from FE80::/10). If this parameter is not set, link-local address is computed automatically from [[en:dpi:dpi_options:opt_bras_l2:bras_l2_vlan_activate:start|bras_arp_mac]]. DPI always has a link-local address.
-♦ ''bras_ipv6_address'' - sets the global DPI IPv6-address. For example, the global address can be useful for pinging DPI from the subscriber. If this parameter is not set, DPI does not have a global IPv6-address.
-♦ [[en:dpi:dpi_options:opt_bras_l2:ipv6:icmpv6_opt|ICMPv6 Options]]
-♦ [[en:dpi:dpi_options:opt_bras_l2:ipv6:dhcpv6_opt|DHCPv6 Options]]
-=== Radius-Server Intergation ===
-**Example** of an Access-Request for allocating IPv6 prefixes to the subscriber:
-<code bash>
-Packet-Type = Access-Request
-User-Name = "1106.106"
-Calling-Station-Id = "a0:b1:c2:d3:00:6a"
-Acct-Session-Id = "03119DF4AAB8E41D"
-NAS-Identifier = "FastPCRF"
-NAS-Port-Type = Virtual
-NAS-Port-Id = "1106/106"
-NAS-IP-Address = 188.227.73.40
-VasExperts-Service-Type = DHCPv6
-VasExperts-DHCPv6-Request = Solicit
-VasExperts-DHCPv6-Delegated = 1
-VasExperts-DHCP-ClientId = 0x00010001237d47fca0b1c2d3006a
-</code>
-In this example, QinQ is a subscriber's ID, request is initiated by Solicit DHCPv6 packet (''VasExperts-Service-Type = DHCPv6'', ''VasExperts-DHCPv6-Request = Solicit''), the subscriber request includes PD-prefix (''VasExperts-DHCPv6-Delegated = 1'').
-<note warning>CPE can request an IPv6-address and a PD-prefix either in one or separate DHCPv6-requests. That is why you should not rely on the ''VasExperts-DHCPv6-Delegated'' attribute value: even if the subscriber does not request a PD-prefix, the Radius can allocate one. The DPI will save it, and if the CPE will request it later, DPI will return the previously allocated PD</note>
-**Example** of response:
-<code bash>
-Packet-Type = Access-Accept
-User-Name="abonent-106"
-VasExperts-Multi-IP-User = 1
-Framed-IPv6-Prefix = 2001:cafe:32:106::/64
-Delegated-IPv6-Prefix = 2001:de1e:32:106::/64
-DNS-Server-IPv6-Address = 2001:feac::1
-DNS-Server-IPv6-Address = 2001:feac::2
-Session-Timeout = 7200
-Idle-Timeout = 600
-VasExperts-Policing-Profile = "rate_100M"
-VasExperts-Service-Profile = "1:test1"
-VasExperts-Enable-Service = "9:on"
-VasExperts-Enable-Service = "12:on"
-</code>
-In this example, the subscriber recieves two **different** prefixes:
-  * ''Framed-IPv6-Prefix = 2001:cafe:32:106::/64'' - DPI will allocate IPv6 addresses to a subscriber from this pool
-  * ''Delegated-IPv6-Prefix = 2001:de1e:32:106::/64'' - this delegated prefix is transmitted to CPE (if the CPE requests PD)
-It is important to note:
-  - for IPv6, the address **always** has to be bound with login. Login is a unique subscriber ID, which can be associated with many IPv4-addresses and IPv6-prefixes. Subscriber's login is specified in ''Access-Accept'' in attribute ''User-Name'' or ''VasExperts-UserName''.
-  - If the subscriber has several IPv6-prefixes (like in the example given - IPv6-prefix and PD-prefix), then such subscriber must be marked as multi-bind (''VasExperts-Multi-IP-User = 1'' attribute).
-''Session-Timeout'' attribute sets the time for DPI session (same as accounting-session time): during this time all DHCPv6-requests from this client will be processed by DPI, using parameters previously issued by the Radius. After ''Session-Timeout'' seconds, the current accounting-session will be closed and DHCPv6-request will be transferred again in Radius Радиус Access-Request. If there is no ''Session-Timeout'' attribute in Radius responce, it is considered to be equal with fastdpi.conf-parameter [[en:dpi:bras_bng:opt_bras_l3:bras_steps:radius_auth_setup:radius_auth_conf_params|auth_expired_timeout]].
-IPv6 prefix leasing time is set by fastdpi.conf-parameters [[en:dpi:dpi_options:opt_bras_l2:ipv6:dhcpv6_opt|bras_dhcp6_preferred_lifetime and bras_dhcp6_valid_lifetime]]. You can set the leasing time individually for each subscriber using the Radius attribute ''DHCP-IP-Address-Lease-Time'': this attribute sets preferred lifetime; valid lifetime is twice as big.
-Additional DHCPv6-options can be set with special [[en:dpi:dpi_options:opt_bras_l2:ipv6:dhcpv6_vsa|VasExperts VSA attributes]].