Radius And Profile Configuration For Hierarchical Policies; Applying A Profile To Interfaces With Service Manager; Hierarchical Policy Configuration Considerations - Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - POLICY MANAGEMENT CONFIGURATION GUIDE 2010-10-04 Configuration Manual

RADIUS and Profile Configuration for Hierarchical Policies

Applying a Profile to Interfaces with Service Manager

Hierarchical Policy Configuration Considerations

Copyright © 2010, Juniper Networks, Inc.
You can use profiles to configure policy parameters. There is currently no RADIUS VSA
support for policy parameters. Each reference to an external parent group and the chain
of references from that group to other parent groups in a series requires one parent group
resource for each reference and each attachment of the policy containing these references.
The rule that applies to external parent group resource count is: one resource per
(interface, policy attachment type, policy name, external parent group name, parameter
name) tuple; interface is the interface where the policy is attached and policy attachment
type is the type of policy attachment.
A rate-limit instance for the external parent groups is created for each hierarchical
aggregation node, which is a combination of (slot, direction, parent group name, parameter
value) tuple; where slot is the slot number, direction is ingress or egress. A rate-limit
resource will be consumed for each instance created.
If at least one policy attachment that uses an external parent group reference has
statistics enabled, then statistics for the rate-limit configured within the external parent
group is enabled. Each hierarchical aggregation node requires five statistics resources.
Applying a profile to the interface where the subscriber sends and receives traffic activates
service for a subscriber. Similarly, to deactivate a service, you reapply the respective
profile with a negate flag.
You can use a profile to apply the policy parameters configuration for an interface. When
you apply a profile containing relevant policy parameter commands to an interface, the
parameter configuration is uniquely maintained for each dynamic interface created using
this profile. The policy parameters are not deactivated when the corresponding service
containing them is deactivated and can only be modified or created by service activations.
If you write service manager macros, you should define the rate-limit hierarchy when you
create the policies and profiles associated with the services to be deployed.
When you configure hierarchical policies for interface groups, be aware of the following
considerations:
Loops—The system performs basic checks to prevent formation of loops when external
parent groups refer to other external parent groups. Also, you cannot chain together
more than four rate-limits in a hierarchy.
Asynchronous Policy Parameter Configuration—You can individually configure the
policy parameter configuration in an interface and the policy attachments. If a policy
parameter is not configured in the interface before a policy is attached, the value
configured in Global Configuration mode for this parameter is used. You can later
change the parameter value for the interface.
Chapter 7: Creating Hierarchical Policies for Interface Groups
127