Subscriber Session Context

As you know, a subscriber must be associated with the service. The service does not define unique constraints for the user. It only details how to transform those constraints into radius attributes sent to each radius client. Different vendors have different functionality and therefore, the attributes must be uniquely defined for each vendor.

Users belong to a specific Subscriber Session Context. This context will change over the lifecycle of the user's session. The context a user belongs to dictates which state their current session is in.

Subscriber Sessions are located under Subscriber Management > Sessions.

It is important to understand the Subscriber Session Context. An explanation of the different contexts a user could belong to can be found in the table below.

Please refer to Radius Flow to see how these profiles are used during the life cycle of a session.

Creating a Service Profile

A new Service Profile can be created by navigating to Subscriber Management > Service Profiles and selecting the New button found at the bottom of the table on this page.

• Name - Unique Service Profile name. (example: Broadband PPPOE)

• Dynamic IP Pool - Define a default pool of IP addresses to assign to subscribers authenticating using this service.

• Deactivate IP Pool - If not assigned, it falls to the Dynamic IP Pool. When a subscriber is marked suspended for any reason, he will be allocated an IP address from the pool.

• Authentication - Type of Authentication for Service. (default: username+password)

Service Profile RADIUS Attributes

Remote Authentication Dial-In User Service (RADIUS) attributes are used to define specific authentication, authorisation, and accounting (AAA) communication parameters. The data between a RADIUS server and a RADIUS client is exchanged in RADIUS packets containing attributes.

The client being a NAS, for example, will send a specific set of attributes such as user-name and user-password to the RADIUS Server in an access-request packet. The Radius server must reply with either an access-accept or access-reject packet towards the NAS. The user will be permitted to connect when the NAS receives the access-accept packet. The attributes in the access-packet define how the NAS should configure the new user session. This includes, for example, constraints such as bandwidth limitations, class-of-service and more.

It's important to understand that not all Radius clients use the same attributes, and all vendors have different sets of supported features implemented differently. However, some generic / IETF RFC attributes, such as Framed-IP-Address, work on almost all major vendor equipment. (Framed-IP-Address is used to define a static IP address, for example)

On our Subscriber Management, you assign a Subscriber (user account), a Service Profile, and a Subscriber Profile. When we receive an access-request from a defined RADIUS client, we will identify its client profile as configured on the client. For more information on creating a Client Profile, refer to the Creating a new Client Profile section of the Virtual Server documentation. If we can locate the subscriber account, authentication will be performed and then, based on the service profile defined on the subscriber account, we will respond with the attributes defined on the service profile.

The attributes have predefined variables that can be used for their values and are populated by the values configured on the subscribers profile. For example, the Upload and Download bandwidth is specified on the subscriber profile and the value of an attribute configured in the service can refer to either or both variables that contain the upload and download speed.

Services essentially define how customer service is provisioned using Radius Attributes on a specific client based on its client profile. Examples of services are: Mobile 5G/LTE, Broadband IPOE, Broadband PPPOE and WIFI Hotspot.

There are different sets of Radius Attributes for different purposes and contexts. These contexts also relate to the Subscriber session context mentioned earlier on this page. We define these attributes on the services.

Context Attributes define attributes only specific to a subscriber's context. Other Attributes are for managing or defining custom attributes used within the scope of all contexts.

The context attributes are used as per table:

Example of Attributes Configured

The following example is taken from a customer using Juniper BNG MX-Series routers.