CLI for Subscribers Management

Subscriber management commands

subs auth

Subscriber authorization status control commands. The subscriber is identified with his IP-address. You can specify a single IP address or a group of addresses as CIDR or as a range of IP addresses:

fdpi_cli subs auth show [IP | CIDR | IP_RANGE] # IP - a single specified IP-address # CIDR - all subscribers from the specified subnet # IP_RANGE - all subscribers from the specified range. The end of the range is NOT considered. # Examples: # IP - a specified IP-address fdpi_cli subs auth show 192.168.10.10 # CIDR fdpi_cli subs auth show 10.240.34.0/24 fdpi_cli subs auth show 2001:67:abcd::67/56 # IP_RANGE fdpi_cli subs auth show 192.168.56.32 - 192.168.56.76 fdpi_cli subs auth show 2001:67:abcd:: - 2001:67:abcd:56::

subs auth show

The command displays the status of subscribers' authorization. Displaying authorization status for all subscribers:

fdpi_cli subs auth show all

Displaying authorization status for a specified IP-address or a range of IP-addresses:

fdpi_cli subs auth show [IP | CIDR | IP_RANGE] # Examples: # IP - a specified IP-address fdpi_cli subs auth show 192.168.10.10 # CIDR fdpi_cli subs auth show 10.240.34.0/24 fdpi_cli subs auth show 2001:67:abcd::67/56 # IP_RANGE fdpi_cli subs auth show 192.168.56.32 - 192.168.56.76 fdpi_cli subs auth show 2001:67:abcd:: - 2001:67:abcd:56::

subs auth set

Sets subscribers' authorization status.

General command format:

fdpi_cli subs auth set [ip-range] [params]

ip-range:

an IPv4 or IPv6-address - setting the authorization status for a specific subscriber.

IPv4/IPv6 CIDR - setting the authorization status for all subscribers of a given CIDR.

range of IP-addresses - setting the authorization status for all subscribers from this range. The end of the range is NOT considered.

all - setting the authorization status for all IP-addresses found in the DPI.

params - the parameters:

state=unk|auth|noauth - authorization status: unknown (unk), authorized (auth), unauthorized (noauth). The "Unknown" status is similar to command subs auth clear, status "Unauthorized" - is similar to getting Access-Reject from Radius, "Authorized" - similar to Access-Accept

expired=<time> - authorization time. <time> can be specified relative to the current time (seconds) or as an absolute time in the future in the format YYYY-MM-DDTHH:MM:DD. Specifying expired=0 is equivalent to clearing the expiration time, which will lead to L3-authorization request as the packet from the subscriber arrives.

Examples:

# Setting the authorization status for 600 seconds for a specific subscriber fdpi_cli subs auth set 192.168.20.30 state=auth expired=600 # Clearing the authorization status for the specified CIDR fdpi_cli subs auth set 2001:67:abcd::67/56 state=unk expired=0 # Clearing authorization status for all fdpi_cli subs auth set all state=unk expired=0 # Extend current authorization status by 1 hour for all IPs in the range (192.168.56.76 is excluded) fdpi_cli subs auth set 192.168.56.32 - 192.168.56.76 expired=3600 # Setting status and absolute end time for a range fdpi_cli subs auth set 192.168.56.32 - 192.168.56.76 state=auth expired=2019-10-23T00:00:00

subs auth clear

Resetting the authorization status of subscribers. The authorization status is set to "unknown", which will lead to L3-authorization request as the packet from the subscriber arrives.

Resetting the authorization status for all subscribers:

fdpi_cli subs auth clear all

Resetting the authorization status for a specified IP-address or range of IP-addresses:

fdpi_cli subs auth clear [IP | CIDR | IP_RANGE] # Examples: # IP - a specified IP-address fdpi_cli subs auth clear 192.168.10.10 fdpi_cli subs auth clear 2001:67:abcd::67/56 # CIDR fdpi_cli subs auth clear 10.240.34.0/24 fdpi_cli subs auth clear 2001:67:abcd::67/56 # IP_RANGE - the end of the range is NOT considered. fdpi_cli subs auth clear 192.168.56.32 - 192.168.56.76 fdpi_cli subs auth clear 2001:67:abcd:: - 2001:67:abcd:56::

subs ping

Sending an ICMP echo request (ping) to the subscriber. Similar to system comand ping. Works only in L2 BRAS mode.

fdpi_cli -r <address> ping ip=<IP-address> [options]

ip - subscriber's IP-address (IPv4 or IPv6)

[options]:

n=N - number of pings, 0 - infinite (Ctrl-C to finish)

len=N - payload length, bytes, 64 by default. It should be noted that the subs ping command is not able to fragment packets, it always sends one packet. The payload length is limited to 1400 bytes.

ttl=N - TTL value, 32 by default.

Examples:

fdpi_cli -r 127.0.0.1 ping ip=172.168.10.20 n=3 fdpi_cli -r 127.0.0.1 ping ip=172.168.10.20 n=50 len=1000 ttl=2

Subscriber L2 properties are taken from the UDR, but they can be overwritten (all or only some) with the following parameters:

mac=X:X:X:X:X:X - subscriber's MAC-address;

vlan=N, vlan=N.N - subscriber's VLAN or Q-in-Q;

iface=N - DNA interface index to which to send the packet.

Examples:

fdpi_cli -r 127.0.0.1 ping ip=172.168.10.20 mac=01:02:03:60:70:99 n=3
fdpi_cli -r 127.0.0.1 ping ip=172.168.10.20 mac=01:02:03:60:70:99 vlan=123.56 n=50 len=1000 ttl=2

Limitation: the command may not work in multicluster mode without aggregation.

subs ping inet

Checking the availability of the internet.
The packet goes through the whole stack of functions and services, polysensing, etc., only after that it goes to the Internet. In this way you can determine whether the problem is on the Internet aplink, between BRAS subscribers, or on BRAS.

Hint: fdpi_cli ping inet ?

subs prop

Commands for viewing and modifying L2 properties of the subscriber (replace fdpi_ctrl --ip_prop)

subs prop show

Viewing L2 subscriber properties for a given IPv4 or IPv6 address, MAC or subs_id

subs prop show <IP>
Examples:
subs prop show 10.240.34.56
subs prop show 2001:67:abcd::67/64

subs prop show mac=<MAC>
Example:
subs prop show mac=02:42:89:33:7b:3e

subs prop show subs_id=<MAC>
Example:
subs prop show subs_id=00:1b:21:bc:a3:0c

Hint:

fdpi_cli help subs prop show

subs prop set

Modifying a subscriber's L2 properties, adding a new subscriber with specified L2 properties, and removing certain L2 properties.

The command includes a flag to disable L3 authorization for a specific subscriber disable_l3_auth.

Configuration is performed via the CLI using the following parameter:

disable_l3_auth=1 — disable L3 authentication;

disable_l3_auth=0 — enable L3 authentication (default value).

For the full syntax, see

fdpi_cli help subs prop set

subs prop del

Removing all L2 properties of the specified subscriber. Examples:

subs prop del 10.240.34.56
subs prop del 2001:67:abcd::67/64

This command actually removes the IP address from the internal database. To remove a specific subscriber property, use subs prop set.

subs traffic stat

Output billing statistics and rating group statistics for the specified subscriber, if they are connected.

subs bind show

View the list of IP addresses bound to a login.
Operating modes:

memory (default) — displays the IP-to-login binding as currently configured in fastDPI.

udr — displays the IP-to-login binding from UDR.

The output of these two modes may differ: not all IP←→login bindings are stored in UDR; for example, for Framed-Route subnets, the login binding is created only in memory, while the framed-route subnets themselves are stored in UDR in a separate table, see the CLI command group cli framed route ?

Example:

subs bind show <login> [memory|udr]

dev info

Displays device information.

fdpi_cli dev info

Main characteristics:

Device identifier and description

MAC address and LAG

PCI bus

Driver and firmware

Current MTU

Device capabilities:

Number of queues (receive/transmit)

MTU limits

Buffer sizes

Maximum number of queues

Descriptor limits

Supported speeds

Flags and offload capabilities:

Device flags

RX offload capabilities (checksums, VLAN, RSS, etc.)

TX offload capabilities (checksums, TSO, VLAN, etc.)

Queue offload capabilities

RSS support for different traffic types

Default configurations:

RX/TX configuration settings

Descriptor limits

Port settings

Additional:

Number of xstat counters