Subscriber management commands

Subscriber authorization status control commands. The subscriber is identified with his IP-address. You can specify a single IP address or a group of addresses as CIDR or as a range of IP addresses:

fdpi_cli subs auth show [IP | CIDR | IP_RANGE]
  # IP - a single specified IP-address
  # CIDR - all subscribers from the specified subnet
  # IP_RANGE - all subscribers from the specified range. The end of the range is NOT considered.
 
# Examples:
  # IP - a specified IP-address
fdpi_cli subs auth show 192.168.10.10
 
  # CIDR
fdpi_cli subs auth show 10.240.34.0/24
fdpi_cli subs auth show 2001:67:abcd::67/56
 
  # IP_RANGE
fdpi_cli subs auth show 192.168.56.32 - 192.168.56.76
fdpi_cli subs auth show 2001:67:abcd:: - 2001:67:abcd:56::

The command displays the status of subscribers' authorization. Displaying authorization status for all subscribers:

fdpi_cli subs auth show all

Displaying authorization status for a specified IP-address or a range of IP-addresses:

fdpi_cli subs auth show [IP | CIDR | IP_RANGE]
 
# Examples:
  # IP - a specified IP-address
fdpi_cli subs auth show 192.168.10.10
 
  # CIDR
fdpi_cli subs auth show 10.240.34.0/24
fdpi_cli subs auth show 2001:67:abcd::67/56
 
  # IP_RANGE
fdpi_cli subs auth show 192.168.56.32 - 192.168.56.76
fdpi_cli subs auth show 2001:67:abcd:: - 2001:67:abcd:56::

Sets subscribers' authorization status.

General command format:

fdpi_cli subs auth set [ip-range] [params]

ip-range:

• an IPv4 or IPv6-address - setting the authorization status for a specific subscriber.
• IPv4/IPv6 CIDR - setting the authorization status for all subscribers of a given CIDR.
• range of IP-addresses - setting the authorization status for all subscribers from this range. The end of the range is NOT considered.
• all - setting the authorization status for all IP-addresses found in the DPI.

params - the parameters:

• state=unk|auth|noauth - authorization status: unknown (unk), authorized (auth), unauthorized (noauth). The "Unknown" status is similar to command subs auth clear, status "Unauthorized" - is similar to getting Access-Reject from Radius, "Authorized" - similar to Access-Accept
• expired=<time> - authorization time. <time> can be specified relative to the current time (seconds) or as an absolute time in the future in the format YYYY-MM-DDTHH:MM:DD. Specifying expired=0 is equivalent to clearing the expiration time, which will lead to L3-authorization request as the packet from the subscriber arrives.

Examples:

  # Setting the authorization status for 600 seconds for a specific subscriber
fdpi_cli subs auth set 192.168.20.30 state=auth expired=600
 
  # Clearing the authorization status for the specified CIDR
fdpi_cli subs auth set 2001:67:abcd::67/56 state=unk expired=0
 
  # Clearing authorization status for all
fdpi_cli subs auth set all state=unk expired=0
 
  # Extend current authorization status by 1 hour for all IPs in the range (192.168.56.76 is excluded)
fdpi_cli subs auth set 192.168.56.32 - 192.168.56.76 expired=3600
 
  # Setting status and absolute end time for a range
fdpi_cli subs auth set 192.168.56.32 - 192.168.56.76 state=auth expired=2019-10-23T00:00:00

Resetting the authorization status of subscribers. The authorization status is set to "unknown", which will lead to L3-authorization request as the packet from the subscriber arrives.

Resetting the authorization status for all subscribers:

fdpi_cli subs auth clear all

Resetting the authorization status for a specified IP-address or range of IP-addresses:

fdpi_cli subs auth clear [IP | CIDR | IP_RANGE]
 
# Examples:
  # IP - a specified IP-address
fdpi_cli subs auth clear 192.168.10.10
fdpi_cli subs auth clear 2001:67:abcd::67/56
 
  # CIDR
fdpi_cli subs auth clear 10.240.34.0/24
fdpi_cli subs auth clear 2001:67:abcd::67/56
 
  # IP_RANGE - the end of the range is NOT considered.
fdpi_cli subs auth clear 192.168.56.32 - 192.168.56.76
fdpi_cli subs auth clear 2001:67:abcd:: - 2001:67:abcd:56::

Sending an ICMP echo request (ping) to the subscriber. Similar to system comand ping. Works only in L2 BRAS mode.

fdpi_cli -r <address> ping ip=<IP-address> [options]

ip - subscriber's IP-address (IPv4 or IPv6)

[options]:

• n=N - number of pings, 0 - infinite (Ctrl-C to finish)
• len=N - payload length, bytes, 64 by default. It should be noted that the subs ping command is not able to fragment packets, it always sends one packet. The payload length is limited to 1400 bytes.
• ttl=N - TTL value, 32 by default.

Examples:

fdpi_cli -r 127.0.0.1 ping ip=172.168.10.20 n=3
fdpi_cli -r 127.0.0.1 ping ip=172.168.10.20 n=50 len=1000 ttl=2

Subscriber L2 properties are taken from the UDR, but they can be overwritten (all or only some) with the following parameters:

• mac=X:X:X:X:X:X - subscriber's MAC-address;
• vlan=N, vlan=N.N - subscriber's VLAN or Q-in-Q;
• iface=N - DNA interface index to which to send the packet.

Examples:

fdpi_cli -r 127.0.0.1 ping ip=172.168.10.20 mac=01:02:03:60:70:99 n=3 
fdpi_cli -r 127.0.0.1 ping ip=172.168.10.20 mac=01:02:03:60:70:99 vlan=123.56 n=50 len=1000 ttl=2

Limitation: the command may not work in multicluster mode without aggregation.

Checking the availability of the internet.
The packet goes through the whole stack of functions and services, polysensing, etc., only after that it goes to the Internet. In this way you can determine whether the problem is on the Internet aplink, between BRAS subscribers, or on BRAS.

Hint: fdpi_cli ping inet ?

Commands for viewing and modifying L2 properties of the subscriber (replace fdpi_ctrl --ip_prop)

Viewing L2 subscriber properties for a given IPv4 or IPv6 address, MAC or subs_id

subs prop show <IP>

Examples:
subs prop show 10.240.34.56
subs prop show 2001:67:abcd::67/64

subs prop show mac=<MAC>

Example:
subs prop show mac=02:42:89:33:7b:3e

subs prop show subs_id=<MAC>

Example:
subs prop show subs_id=00:1b:21:bc:a3:0c

Hint:

fdpi_cli help subs prop show 

Modifying a subscriber's L2 properties, adding a new subscriber with specified L2 properties, and removing certain L2 properties.

The command includes a flag to disable L3 authorization for a specific subscriber disable_l3_auth.

Configuration is performed via the CLI using the following parameter:

• disable_l3_auth=1 — disable L3 authentication;
• disable_l3_auth=0 — enable L3 authentication (default value).

For the full syntax, see

fdpi_cli help subs prop set

Removing all L2 properties of the specified subscriber. Examples:

subs prop del 10.240.34.56
subs prop del 2001:67:abcd::67/64

This command actually removes the IP address from the internal database. To remove a specific subscriber property, use subs prop set.

Displays accumulated billing statistics and rating group statistics for a subscriber, if they are enabled.

Command format:

fdpi_cli subs traffic stat <IP-address>
fdpi_cli subs traffic stat login=<login> [ip4|ip6]

where:

• <IP-address> — subscriber's IPv4 or IPv6 address. Statistics for the specified address are displayed;
• login=<login> — subscriber's login. Total statistics for all IP addresses of the login are displayed;
• ip4, ip6 — optional parameter for a login query. Statistics only for IPv4 or only for IPv6 addresses of the login are displayed.

Examples:

fdpi_cli subs traffic stat 10.240.34.56
fdpi_cli subs traffic stat 2001:67:abcd::
fdpi_cli subs traffic stat login=JSmith
fdpi_cli subs traffic stat login=JSmith ip4
fdpi_cli subs traffic stat login=JSmith ip6

To measure a subscriber's current speed, use the aliases from the bngaliases package:

• speedip <IP-address> — displays the subscriber's per-second speed for the specified IP address;
• speedlogin <login> — displays the subscriber's per-second speed for the login.

For the aliases to work, service 9 must be enabled for the subscriber (by IP address or login).

Package installation:

dnf clean all
yum install bngaliases

View the list of IP addresses bound to a login.
Operating modes:

• memory (default) — displays the IP-to-login binding as currently configured in fastDPI.
• udr — displays the IP-to-login binding from UDR.

The output of these two modes may differ: not all IP←→login bindings are stored in UDR; for example, for Framed-Route subnets, the login binding is created only in memory, while the framed-route subnets themselves are stored in UDR in a separate table, see the CLI command group cli framed route ?

Example:

subs bind show <login> [memory|udr]

Displaying statistics for the L2 BRAS database.

Displays device information.

 fdpi_cli dev info

Main characteristics:

1. Device identifier and description
2. MAC address and LAG
3. PCI bus
4. Driver and firmware
5. Current MTU

Device capabilities:

1. Number of queues (receive/transmit)
2. MTU limits
3. Buffer sizes
4. Maximum number of queues
5. Descriptor limits
6. Supported speeds

Flags and offload capabilities:

1. Device flags
2. RX offload capabilities (checksums, VLAN, RSS, etc.)
3. TX offload capabilities (checksums, TSO, VLAN, etc.)
4. Queue offload capabilities
5. RSS support for different traffic types

Default configurations:

1. RX/TX configuration settings
2. Descriptor limits
3. Port settings

Additional:

1. Number of xstat counters