Limiting Active Subscribers; Notifying Radius Of Aaa Failure - Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - BROADBAND ACCESS CONFIGURATION GUIDE 2010-10-12 Configuration Manual

Limiting Active Subscribers

aaa subscriber limit per-port
aaa subscriber limit per-vr

Notifying RADIUS of AAA Failure

aaa accounting acct-stop on-aaa-failure
Copyright © 2010, Juniper Networks, Inc.
Use the no version to restore the idle or session timeout to its default value, 0 seconds,
and to disable ingress-only traffic monitoring for the idle timeout if it is configured.
See aaa timeout
You can limit the number of active subscribers on a port or virtual router.
Use to limit the number of active subscribers permitted on a port.
Example
host1(config)#aaa subscriber limit per-port 2/0 20
Use the no version to return to the default value, 0 (zero).
See aaa subscriber limit per-port
Use to limit the number of active subscribers permitted on a virtual router.
Because profiles are applied to subscribers after the PPP authentication phase,
subscribers that have their VR context specified by profiles are not denied access.
Instead, when IP notifies AAA of the subscribers VR context, AAA checks limits. If the
subscriber exceeds the VR limit, AAA revokes the subscriber's access and logs out the
subscriber.
Example
host1:vr17(config)#aaa subscriber limit per-vr 20
Use the no version to return to the default value, 0 (zero).
See aaa subscriber limit per-vr
If a user passes RADIUS authentication, but fails AAA authentication, the RADIUS server
may still allocate an address for the user from its internal address pool. To indicate to
the RADIUS server to free the address, you can set up the router to send an Acct-Stop
message if a user fails AAA.
Use to cause the router to send an Acct-Stop message if a user fails AAA, but RADIUS
grants access.
Example
host1:vr17(config)#aaa accounting acct-stop on-aaa-failure disable
Chapter 1: Configuring Remote Access
87