Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - LINK LAYER CONFIGURATION GUIDE 2010-10-13 Configuration Manual page 556

JunosE 11.3.x Link Layer Configuration Guide
524
When the time between lockout events is greater than either 15 minutes or the maximum
lockout time, the value of n reverts to 1. This condition is referred to as a grace period.
The lockout time never exceeds the maximum configured lockout time. For example,
for a configured lockout time in the range 20–120 seconds, the increasing lockout time
sequence is 20 seconds, 40 seconds, 80 seconds, and finally, 120 seconds.
A short-cycle event is a dynamic interface that is created and torn down within 60
seconds. The router tracks the time between short-cycle events to determine whether
to increase the lockout time for a subsequent short-cycle event.
NOTE: When the calculated lockout time is equal to or exceeds the
maximum lockout time, the router uses the maximum lockout time value
until the time to the next event exceeds the greater of 15 minutes or the
maximum lockout time value. At that point, the lockout time reverts to the
minimum lockout time value.
The minimum lockout time value cannot exceed the maximum lockout time value.
When the minimum and maximum values are equal, the encapsulation type lockout
time becomes fixed.
Guidelines for Configuring Encapsulation Type Lockout for IWF PPPoE Sessions
Keep the following points in mind while configuring dynamic encapsulation type lockout
for IWF PPPoE sessions:
If the digital subscriber line access multiplexer (DSLAM) network does not add the
DSL Forum VSAs (Agent-Circuit-Id and Agent-Remote-Id) that are required to
accurately and uniquely identify the subscriber access loop, dynamic encapsulation
type lockout for PPPoE clients is performed using MAC address as the only criterion
to identify subscribers.
In such conditions, the mode of working of encapsulation type lockout for PPPoE clients
is the same as the behavior that existed when lockout of PPPoE clients was performed
using the MAC address of the client as the only matching parameter.
If the Agent-Circuit-Id DSL Forum VSA (26-1) is not contained in the PADR packet sent
from the PPPoE client or is not unique for each IWF PPPoE session that originates from
the client, the Agent-Remote-Id DSL VSA (26-2) is used along with the MAC address
as the filter criteria to uniquely identify the subscriber session that needs to be locked
out.
When you enter the pppoe auto-configure lockout-time command in Interface
Configuration mode or Subinterface Configuration mode to configure dynamic
encapsulation type lockout, even if PPPoE sessions associated with a particular MAC
address are locked out, other PPPoE sessions that originated with the same MAC
address are not terminated (continue to remain logged in) if they are IWF sessions
from different access loops (PPPoE clients) and this information is available to the
B-RAS application.
Copyright © 2010, Juniper Networks, Inc.