Manual Chapter :
Configuring Subscriber Discovery based on DHCP
Applies To:
Show VersionsBIG-IP LTM
- 16.0.1, 16.0.0, 15.1.8, 15.1.7, 15.1.6, 15.1.5, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0
BIG-IP PEM
- 16.0.1, 16.0.0, 15.1.8, 15.1.7, 15.1.6, 15.1.5, 15.1.4, 15.1.3, 15.1.2, 15.1.1, 15.1.0, 15.0.1, 15.0.0
Configuring Subscriber Discovery based on DHCP
Overview: Configuring subscriber discovery based on DHCP
The Policy Enforcement Manager™ uses DHCP to discover subscribers. The DHCP
consists of two components, which includes a protocol for delivering host-specific parameters
from a DHCP server to a host, and the ability to allocate network addresses to hosts. The BIG-IP system processes the DHCP traffic between subscribers and DHCP server
and extracts of the subscriber's identity and other information that is important for subscriber
handling.
The BIG-IP DHCP module has two functional modes:
- Relay mode: The DHCP-Relay agent handles the DHCP traffic from the subscriber, modifies it as required, and relays it to the DHCP server according to the configuration.
- Forward or pass-through mode: The DHCP module does not relay the messages or modify the message in this mode.
In both modes, the DHCP module snoops the DHCP packets, parses relay-agent options and the
allocated IP address, and then extracts session information. The relay-agent options are option
82 for DHCPv4 and options 37 and 38 for DHCPv6.
The DHCP module monitors the clients DHCP traffic after the initial IP allocation and snoops
for DHCP lease renewal packets, releasing of the IP address, and reconfiguring requests. This
determines when the BIG-IP system can safely delete the session.
Creating a listener for DHCPv4 discovery virtual
You can use DHCP to discover subscribers in order to handle traffic for policy
enforcement. For subscribers discovered through DHCP, an identifier comprises of relay
agent information option (option 82) and MAC address, as configured in the corresponding
DHCP profile.
- On the Main tab, click.The Control Plane Listeners page opens.
- SelectDHCPv4from the profiles list, and clickAdd.The New DHCPv4 Discovery Virtual screen opens.
- In theNamefield, type a unique name for the listener.
- In theDescriptionfield, type a description of the listener.
- For theSourcesetting, type the IP address or network from which the virtual server will accept traffic.
- In theDestination Addressfield, type the IP address of the virtual server. For example,10.0.0.1or10.0.0.0/24.When you use an IPv4 address without specifying a prefix, the BIG-IP system automatically uses a/32prefix.You can use a catch-all virtual server (0.0.0.0) to specify all traffic that is delivered to the BIG-IP system. Configure the source and destination setting, during forwarding mode only. In the relay mode, the client does not have an IP address and the DHCP provides the client with an IP address.The system will create a virtual server using the address or network you specify.
- From theVLAN and Tunnel Trafficlist, selectEnabled on. Then, for theVLANs and Tunnelssetting, move the VLAN or VLANs on which you want to allow the virtual servers to share traffic from theAvailablelist to theSelectedlist.
- For theVLANs and Tunnelssetting, move the VLANs and tunnels that you want to monitor from theAvailablelist to theSelectedlist.
- For theDHCP Modesetting, selectRelayorForwardto specify the mode in which the DHCP client requests are sent.
- For thePool Member Configurationsetting, add the DHCP virtual servers that are to be members of the pool. Type theMember IP AddressandPortnumber, then clickAdd.
- From theSubscriber Discoverylist, selectEnabled. Then, for theSubscriber ID Formatsetting, select the format you want to implement.FormatDescriptionMAC AddressUses the subscriber ID as the MAC address through which the subscriber ID goes through.Relay Agent Option: Suboption ID 1Uses the relay agent first option suboption ID.Relay Agent Option: Suboption ID 1 + <Separator> + Suboption ID 2Uses the relay agent first and second suboption IDs.MAC Address + <Separator> + Relay Agent Option: Suboption ID 1Uses the MAC Address and the relay agent first suboption ID.MAC Address + <Separator> + Relay Agent Option: Suboption ID 1 <Separator> + Suboption ID 2Uses the relay agent first option suboption ID.TCL ExpressionUses the TCL expression to format the subscriber ID.
- From theAuthentication Settingslist, selectEnabled. Then, select the virtual server name from theAuthentication Virtuallist. Select theUser Name Formatyou want to implement.TheUser Name Formathas the same options as theSubscriber ID Format, in the Subscriber Discovery setting.
- ClickFinished.The Policy Enforcement Manager creates a listener.
When you create a new DHCPv4 discover virtual, the Policy
Enforcement Manager also creates a corresponding DHCPv4 profile.
Creating a DHCPv4 profile for policy enforcement
You can create a DHCP profile when you want to configure the DHCP virtual to use
Relay mode or Pass-through mode.
- On the Main tab, click.
- ClickCreate.The New DHCPv4 Profile screen opens.
- In theDescriptionfield, type a descriptive text that identifies the profile.
- From theParent Profilelist, select the defaultdhcpv4profile.
- Select theCustomcheck box.
- In the Protocol and Proxy Settings Features area, make a selection from theDHCP Modelist.OptionDescriptionRelayWhen in relay mode, a virtual server relays Dynamic Host Control Protocol (DHCP) client requests and applies unicast IP addresses as the relayed message destination.ForwardWhen in forward mode, a virtual server forwards Dynamic Host Control Protocol (DHCP), and does not modify, client requests for an IP address to one or more DHCP servers.
- For theIdle Timeoutsetting, type the number of seconds that a BIG-IP DHCP connection is idle before the connection is eligible for deletion.
- For theMax Hopssetting, select theCustomcheck box to enable this option. Type the maximum expected number of relay agents that the messages should pass through, before reaching the DHCPv4 server.
- For theDefault TTLsetting, select theCustomcheck box to enable this option. Type the time to live (TTL) value that you want to set for each outgoing DHCP packet.
- For theDefault Lease Timesetting, select theCustomcheck box to enable this option. Type the time, in seconds, of the default value of the DHCPv4 lease time.
- For theTTL Decrement Amountsetting, select theCustomcheck box to enable this option. Type the amount that the DHCP virtual will use to decrement the TTL for each outgoing DHCP packet.
- For theTransaction Timeoutsetting, select theCustomcheck box to enable this option. Type the number of seconds, taken to internally process the messages.
- If you want the DHCP module to insert option 82, for theInsert Relay Agent ID (Option 82)setting, select theCustomcheck box.
- If you want the DHCP relay agent to remove option 82 from the server to client traffic, for theRemove Relay Agent ID From Client Messagessetting, select theCustomcheck box to enable this option.
- From theSubscriber Discoverylist, selectEnabled. Then, for theSubscriber ID Formatsetting, select the format you want to implement.FormatDescriptionMAC AddressUses the subscriber ID as the MAC address through which the subscriber ID goes through.Relay Agent Option: Suboption ID 1Uses the relay agent first option suboption ID.Relay Agent Option: Suboption ID 1 + <Separator> + Suboption ID 2Uses the relay agent first and second suboption IDs.MAC Address + <Separator> + Relay Agent Option: Suboption ID 1Uses the MAC Address and the relay agent first suboption ID.MAC Address + <Separator> + Relay Agent Option: Suboption ID 1 <Separator> + Suboption ID 2Uses the relay agent first option suboption ID.TCL ExpressionUses the TCL expression to format the subscriber ID.
- From theAuthentication Settingslist, selectEnabled. Then, select the virtual server name from theAuthentication Virtuallist. Select theUser Name Formatyou want to implement.TheUser Name Formathas the same options as theSubscriber ID Format, in the Subscriber Discovery setting.
- ClickFinished.
The DHCPv4 profile that you created can be chosen from the DHCPv4 profiles in
, only if you choose DHCP as a virtual type.Creating a listener for DHCPv6 discovery virtual
You can use DHCPv6 to discover subscribers in order to handle traffic for policy
enforcement. For each subscriber discovered through DHCPv6, an identifier comprises of
remote-id, subscriber-id options (options 37 and 38) and MAC address, as configured
in the corresponding DHCPv6 profile.
- On the Main tab, click.The DHCPv6 page open
- SelectDHCPv6from the profiles list, and clickAdd.The New DHCPv6 Discovery Virtual screen opens.
- In theNamefield, type a unique name for the listener.
- In theDescriptionfield, type a description of the listener.
- For theSourcesetting, type the IP address or network from which the virtual server will accept traffic.
- In theDestination Addressfield, type the IP address of the virtual server. For example,ffe1::0020/64or2001:ed8:77b5:2:10:10:100:42/64.For DHCPv6 discovery virtual, the source and destination should be any (::/0).The system will create a virtual server using the address or network you specify.
- From theVLAN and Tunnel Trafficlist, selectEnabled on. Then, for theVLANs and Tunnelssetting, move the VLAN or VLANs on which you want to allow the virtual servers to share traffic from theAvailablelist to theSelectedlist.
- For theVLANs and Tunnelssetting, move the VLANs and tunnels that you want to monitor from theAvailablelist to theSelectedlist.
- For theDHCP Modesetting, selectRelayorForwardto specify the mode in which the DHCP client requests are sent.
- For thePool Member Configurationsetting, add the DHCP virtual servers that are to be members of the pool. Type theMember IP AddressandPortnumber, then clickAdd.
- From theSubscriber Discoverylist, selectEnabled. Then, for theSubscriber ID Formatsetting, select the format you want to implement.FormatDescriptionMAC AddressUses the subscriber ID as the MAC address through which the subscriber ID goes through.MAC Address + <Separator> + Option 37Uses the MAC address and the remote ID relay agent option.MAC Address + <Separator>+ Option 37 <Separator> + Option 38Uses the MAC address, the remote ID relay agent option and the subscriber ID option.MAC Address + <Separator> + Option 38Uses the MAC address and the subscriber ID option.Option 37Uses the remote ID relay agent option.Option 37 <Separator> + Option 38:Uses the remote ID relay agent option and the subscriber ID option.Option 38Uses the subscriber ID option.TCL ExpressionUses the TCL expression to format the subscriber ID.
- From theAuthentication Settingslist, selectEnabled. Then, select the virtual server name from theAuthentication Virtuallist. Select theUser Name Formatyou want to implement.TheUser Name Formathas the same options as theSubscriber ID Format, in the Subscriber Discovery setting.
When you create a new DHCPv6 discover virtual, the Policy
Enforcement Manager also creates a corresponding DHCP profile.
Creating a DHCPv6 profile for policy enforcement
You can create a DHCP profile when you want to configure the DHCP virtual to use
Relay mode or Pass-through mode.
- On the Main tab, click.
- In theDescriptionfield, type a descriptive text that identifies the profile.
- From theParent Profilelist, select the defaultdhcpv6profile.
- Select theCustomcheck box.
- In the Protocol and Proxy Settings Features area, make a selection from theDHCP Modelist.OptionDescriptionRelayWhen in relay mode, a virtual server relays Dynamic Host Control Protocol (DHCP) client requests and applies unicast IP addresses as the relayed message destination.ForwardWhen in forward mode, a virtual server forwards Dynamic Host Control Protocol (DHCP), and does not modify, client requests for an IP address to one or more DHCP servers.
- For theIdle Timeoutsetting, type the number of seconds that a BIG-IP DHCP connection is idle before the connection is eligible for deletion.
- For theMax Hopssetting, select theCustomcheck box to enable this option. Type the maximum expected number of relay agents that the messages should pass through, before reaching the DHCPv4 server.
- For theDefault Lease Timesetting, select theCustomcheck box to enable this option. Type the time, in seconds, of the default value of the DHCPv4 lease time.
- For theTransaction Timeoutsetting, select theCustomcheck box to enable this option. Type the number of seconds, taken to internally process the messages.
- If you want the DHCP module to insert option 37, for theInsert Remote ID (Option 37)setting, select theCustomcheck box .
- If you want the DHCP module to insert option 38, for theInsert Remote ID (Option 38)setting, select theCustomcheck box to enable this option .
- If you want the DHCP relay agent to remove option 37 from the server to client traffic, for theRemove Subscriber Agent ID From Client Messagessetting, select theCustomcheck box.
- If you want the DHCP module to remove option 38 from the server to client traffic, for theRemove Relay Agent ID From Client Messagessetting, select theCustomcheck box.
- From theSubscriber Discoverylist, selectEnabled. Then, for theSubscriber ID Formatsetting, select the format you want to implement.FormatDescriptionMAC AddressUses the subscriber ID as the MAC address through which the subscriber ID goes through.MAC Address + <Separator> + Option 37Uses the MAC address and the remote ID relay agent option.MAC Address + <Separator>+ Option 37 <Separator> + Option 38Uses the MAC address, the remote ID relay agent option and the subscriber ID option.MAC Address + <Separator> + Option 38Uses the MAC address and the subscriber ID option.Option 37Uses the remote ID relay agent option.Option 37 <Separator> + Option 38:Uses the remote ID relay agent option and the subscriber ID option.Option 38Uses the subscriber ID option.TCL ExpressionUses the TCL expression to format the subscriber ID.
- From theAuthentication Settingslist, selectEnabled. Then, select the virtual server name from theAuthentication Virtuallist. Select theUser Name Formatyou want to implement.TheUser Name Formathas the same options as theSubscriber ID Format, in the Subscriber Discovery setting.
- ClickFinished.
The DHCPv6 profile that you created can be chosen from the DHCPv6 profiles in
, only if you choose DHCP as a virtual type.Creating a listener for RADIUS subscriber discovery
You can create listeners that specify the RADIUS discovery virtual for extracting
subscriber information from the RADIUS packets. Creating a listener does preliminary
setup tasks on the BIG-IP system for application visibility,
intelligent steering, bandwidth management, and reporting.
- On the Main tab, click.The Control Plane Listeners page opens.
- From the Subscriber Discovery Virtuals area, selectRADIUS, and clickAdd.The New RADIUS Discovery Virtual screen opens.
- In theNamefield, type a unique name for the RADIUS discovery virtual.
- In theDescriptionfield, type a description of the listener.
- For theSourcesetting, type the IP address or network from which the virtual server will accept traffic.
- In theDestination Addressfield, type the IP address of the virtual server. For example,10.0.0.1or10.0.0.0/24.When you use an IPv4 address without specifying a prefix, the BIG-IP system automatically uses a/32prefix.You can use a catch-all virtual server (0.0.0.0) to specify all traffic that is delivered to the BIG-IP system. Configure the source and destination setting, during forwarding mode only. In the relay mode, the client does not have an IP address and the DHCP provides the client with an IP address.The system will create a virtual server using the address or network you specify.
- To use network address translation, from theSource Address Translationlist, selectAuto Map.The system treats all of the self IP addresses as translation addresses.
- From theVLAN and Tunnel Trafficlist, selectEnabled on. Then, for theVLANs and Tunnelssetting, move the VLAN or VLANs on which you want to allow the virtual servers to share traffic from theAvailablelist to theSelectedlist.
- For thePool Member Configurationsetting, add the RADIUS discovery virtual servers that are to be members of the pool. Type theMember IP AddressandPortnumber, then clickAdd.
- ClickFinished.The Policy Enforcement Manager creates a RADIUS virtual server, and displays in the subscriber discovery list.
When you create a RADIUS discovery virtual for a subscriber, the Policy Enforcement Manager creates a corresponding profile (
).