Configuring Aaa Authentication For Dhcp Local Server Standalone Mode - Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - BROADBAND ACCESS CONFIGURATION GUIDE 2010-10-12 Configuration Manual

Configuring AAA Authentication for DHCP Local Server Standalone Mode

Copyright © 2010, Juniper Networks, Inc.
When you configure a grace period, by default it is applied to address leases that expire,
but not to addresses that are released by clients. However, you can optionally apply the
grace period to released addresses.
The DHCP local server enables you to optionally configure AAA-based authentication
of standalone mode DHCP clients. In addition to providing increased security, AAA
authentication also provides RADIUS-based input to IP address pool selection for
standalone mode clients. By default, clients are not authenticated in standalone mode.
Typically, an incoming DHCP client does not provide a username—therefore, the DHCP
local server constructs a username based on the user's attachment parameters and
optional DHCP parameters. AAA uses the constructed username to authenticate the
incoming client and create the AAA subscriber record for the client. The information in
the AAA subscriber record is then used to determine the IP address pool from which to
assign the address for the DHCP client. You can include the following elements in the
username:
Attachment Parameters
domain
user prefix
–
–
–
NOTE: The nondomain portion of a constructed username must contain at
least one character. Otherwise, the DHCP local server rejects the DHCP client
without performing the AAA authentication request.
When using authentication, AAA accepts the DHCP client as a subscriber—this enables
you to use show commands to monitor configuration information and statistics about
the client. You can also use the logout subscriber command to manage subscribers.
To configure AAA-based authentication for DHCP local server standalone mode clients:
CAUTION: Configuring authentication on the DHCP local server requires that
you first disable the DHCP local server for standalone mode. Doing so removes
your entire DHCP local server configuration. Therefore, if you want to configure
authentication, do so before you have otherwise configured the DHCP local
server.
Chapter 19: Configuring DHCP Local Server
DHCP Parameters
circuit ID
circuit type
MAC address
option 82
virtual router name
483