Subscriber Virtual Servers

Proxy Instances and Virtual Servers

A proxy server is a Lunar instance acting as a secure RADIUS gateway to NebularStack. Whether on a physical host, virtual machine, remote, on-premises, or within the NebularStack distributed cloud, it is a crucial component of your authentication, authorization, and accounting service. One proxy can run multiple instances of proxies to different Virtual AAA instances.

The proxy serves as a bridge between NebularStack backend systems and your radius client (NAS/BNG) nodes.

By default, we assign 3 proxy instances per virtual server. An example of the network topology.

Virtual Servers are located at Subscriber (AAA) > Virtual Servers.

When a Virtual Server is running & Proxy Instances have been assigned, information about the Proxy Instances can be viewed for the Virtual Server in question. This information is located at Subscriber (AAA) > Virtual Servers > {server} > Instances.

The Instances button can be found at the top of the dialog after selecting a Virtual Server.

Your Radius clients should be configured to communicate with all the proxy instances for redundancy purposes on the IP and port numbers provided for authentication and accounting. It is best practice to use port 1812 for authentication, 1813 for accounting, and 3799 for COA.

Creating a new Client Profile

Before you can add clients you must define client profiles. Client profiles are used to identify RADIUS client types; examples are Cisco, Juniper, H3C, Huawei, Mikrotik, etc. Attributes per service are assigned to client profiles, and RADIUS clients are assigned to these profiles. Based on the specific service assigned to the subscriber, we can then identify which attributes are for which RADIUS client.

A new NAS profile can be created by navigating to Subscriber (AAA) > Virtual Servers > Client Profiles and selecting the Add button at the bottom of the open dialog.

Virtual Server Client

Each client must be assigned a Client Profile. There are two types of clients:

• PROXY - For external Radius Proxy.

• NAS - Actual Radius Client.

The Client Profile for a 'proxy' client type is a default value assigned to all network access servers (NAS) behind the proxy if not explicitly configured. You can still add your network access servers as clients with a defined Client Profile even when they are behind an external proxy.

To add a new Virtual Server Client navigate to Subscriber (AAA) > Virtual Servers > {server} > Edit > Add Client.

• Name of the client must be unique and is only used to identify the client.

• Tags You can tag the client. Other features, such as telemetry, can use tags.

• Client Profile is used to associate attributes in services with the clients.

• Secret is shared between the client and our radius platform and used to authenticate the client.

• Reachable IP address of the client.

• The Change of Authorization / COA port of the client, typically 3799 or 1700. It is used for both COA and POD packets.

• Dynamic IP Pool - Define a default pool of IP addresses to assign to subscribers authenticating from this client.

• Deactivate IP Pool - If not assigned, it falls to the Dynamic IP Pool. When a subscriber is marked suspended for any reason, he will be allocated an IP address from the pool.

• Authentication - Optional per-Client override of the authentication method. Leave blank to inherit the Virtual Server. See Authentication.

• Calling-Station-ID fallback - When enabled, a device whose username is not a known subscriber is admitted with no password if its Calling-Station-Id (MAC) matches a subscriber username. Enabling it on the Virtual Server or the Client turns it on. See Authentication Calling-Station-ID fallback.

Virtual Server Authentication

Each Virtual Server has a base Authentication method (default username+password) and an optional Calling-Station-ID fallback toggle, both under Subscriber (AAA) > Virtual Servers > {server} > Overview. The method chosen here applies to the whole Virtual Server unless a Client or Service Profile overrides it.

The available methods (username, username+password and username+password+calling-station-id), how they are inherited across the Virtual Server, Client and Service Profile, the supported password protocols (PAP, CHAP, MS-CHAPv1, MS-CHAPv2), and the migration-friendly Calling-Station-ID fallback are all covered on the Authentication page.