In DHCP Radius proxy mode, a single Radius response can contain both DHCP parameters and authentication parameters (the subscriber's fastDPI profiles). Starting with version 7.4, a mode for processing this data separately is available, which is configured using the fastdpi.conf parameter bras_dhcp_auth_mix:

• 0 — In the DHCP response, RADIUS returns only DHCP parameters;
• 1 — In the DHCP response, RADIUS returns both DHCP and authentication parameters (default value).

When bras_dhcp_auth_mix=0, DHCP and L3 authentication operate independently and are handled separately:

• Both DHCP requests and L3 authorization requests are sent to RADIUS;
• Attributes related to policy and service profiles are ignored in responses to DHCP requests;
• Attributes related to DHCP parameters are ignored in responses to L3 authorization requests.

For L3 authorization to work, you must enable the enable_auth=1 setting.

When set to bras_dhcp_auth_mix=1, DHCP and auth parameters are transmitted in a single response, which reduces the number of requests to RADIUS. However, this mode may not be applicable in scenarios where parameter requirements differ (for example, when Session-Timeout values differ for DHCP and L3 authentication).

Regardless of the value of bras_dhcp_auth_mix, you must enable enable_auth=1 to handle CoA requests.

When L3 authentication is enabled, the following are processed:

• CoA notifications regarding changes to subscriber profiles and connected services;
• Disconnect-Request.

A Disconnect-Request revokes the subscriber's authorization but does not terminate the DHCP session (the subscriber's IP address is retained).

Additional mechanisms for managing L3 authorization are available at both the system level and for individual subscribers.

The bras_disable_l3_auth option allows you to explicitly disable L3 authentication in L2 BRAS mode for all subscribers.

• bras_disable_l3_auth=off — L3 authentication is enabled (default);
• bras_disable_l3_auth=on — L3 authentication is disabled.

This option is only meaningful if enable_auth=1 is enabled.

Features:

• When this option is enabled, only DHCP authentication is used (for example, for subscribers with the AS local tag);
• This option is not compatible with the bras_dhcp_auth_mix=0 mode:
  • When bras_dhcp_auth_mix=0, the value of bras_disable_l3_auth is forcibly set to off;
  • A warning is logged in the alert log.

L3 authorization can be disabled on an individual basis for each subscriber.

Configuration is performed using the CLI command subs prop set with the following parameter:

• disable_l3_auth=1 — disable L3 authentication;
• disable_l3_auth=0 — enable L3 authentication (default value).

This flag applies only to a specific subscriber and allows for flexible control of authorization behavior without changing the global configuration.