Starting with SSG 8.3, the primary client identification keys in DHCP are ClientId (opt61) or, if absent, the MAC address.
Additionally, secondary keys (opt82, QinQ) may be used, which in some scenarios serve as a unique subscriber identifier in the billing system.

When using secondary keys as subscriber identifiers, the following situation may arise:

• the secondary key (e.g., QinQ) remains unchanged;
• the primary key (MAC address) changes (e.g., when replacing the CPE).

In this case, when a DHCP request is sent again:

• the billing system may assign the same IP address;
• SSG creates a new accounting session.

As a result, a single subscriber may have multiple active accounting sessions simultaneously, each corresponding to a different primary key but the same secondary key.

For billing systems that allow only one active session per subscriber, this can lead to the following consequences:

• rejection of the new session;
• refusal to assign an IP address until the previous session ends.

To prevent the situation described above, the bras_dhcp_check_secondary_keys option is used in the SSG DHCP Proxy.

bras_dhcp_check_secondary_keys — Secondary key uniqueness check (opt82/QinQ) [hot]

When this option is enabled, active accounting sessions are checked against secondary keys. If a session is detected with a matching value for one of the secondary keys, it is forcibly terminated (an Accounting-Stop is sent) before a request for an IP address is sent to RADIUS, ensuring correct operation with billing systems that allow only one active session per subscriber.

Values:

• 0 (default) — secondary key checking is disabled
• 1 — checking for all secondary keys (opt82 and QinQ)
• 2 — checking only for opt82
• 4 — checking only for QinQ