Construction Of Ipv6 Classifiers From The Hexadecimal Ascend-Data-Filter Attribute; Ascend-Data-Filter Attribute For Ipv4/Ipv6 Subscribers In A Dual Stack - Juniper POLICY MANAGEMENT - CONFIGURATION GUIDE V11.1.X Configuration Manual

Construction of IPv6 Classifiers from the Hexadecimal Ascend-Data-Filter Attribute

If both the source and destination IP prefixes are 128, the IPv6 classifier is created
using the IPv6 host argument as follows:
If either the source or destination IP prefix is non-zero, but less than 128 bits, (for
example, 64 bits), the IPv6 classifier is created using the IPv6 address argument as
follows:
NOTE: In JUNOSe Release 10.1.x and earlier, the maximum width of a CAM hardware
classifier entry for IPv4 or IPv6 in a single policy was 128 bits. In JUNOSe Release
10.2.x and later, based on the size limit for a combined IPv6 classifier entry, a
maximum of 336 bits of CAM entry is supported for full IPv6 classification with an
additional 16 bits for rule set ID. However, OC48/STM16 line modules on ERX14xx
models, ERX7xx models, and the ERX310 router support only 128-bit IPv6
classification. For more information on size limits for IP and IPv6 classifiers, see
"Size Limit for IP and IPv6 CAM Hardware Classifiers" on page 163.

Ascend-Data-Filter Attribute for IPv4/IPv6 Subscribers in a Dual Stack

The PPP link between the customer premises equipment (CPE) and the provider
edge (PE) device or E Series router equipment might require both IPv4 and IPv6
protocols for transmission of data. Such networks require that PE devices run a dual
stack of IPv4 and IPv6 services. Dual-stack routers allow simultaneous support for
both IPv4 and IPv6 applications. The following guidelines are used to create a policy
defined in the Ascend-Data-Filter attribute when IPv4 and IPv6 subscribers are in a
network:
IPv6 classifier-list testipv6 source-host 2001:db8:85a3::8a2e:370:7334
destination-host 2001:db8::1428:57ab
IPv6 classifier-list v6cl4 source-address 2001:db8:85a3::8a2e:370:7334/64
destination-address 2001:db8::1428:57ab/64
If a subscriber requires only IPv4 services, only the Type 1 action is used in the
Access-Accept message returned from the RADIUS server in response to the
client authentication request.
If a subscriber requires only IPv6 services, only the Type 3 action is used in the
Access-Accept message returned from the RADIUS server.
If both IPv4 and IPv6 addresses are assigned to the subscriber interface, then
either Type 1 or Type 3 or both the actions are used in the Access-Accept
message.
If the Type 1 action is used and the Indirection action field is set to 01 in the
Ascend-Data-Filter attribute, one primary input policy is created and applied on
the ingress IPv4 interface.
If the Type 3 action is used and the Indirection action field is set to 01 in the
Ascend-Data-Filter attribute, one primary input policy is created and applied on
the ingress IPv6 interface.
Chapter 4: Creating Classifier Groups and Policy Rules
Using RADIUS to Create and Apply Policies Overview
49