Skip to content
How to buy Partners Support Start evaluation
NETAVO·BNG
Docs Start evaluation
Skip to content

Dynamic address pools#

A dynamic address pool lets your AAA server hand out an address by naming a pool instead of supplying the address itself. The appliance allocates from the pool, returns the address when the session ends, and tries to give a reconnecting subscriber the address it had before.

Pool families#

Family What a subscriber gets RADIUS attribute naming the pool
ipv4 an IPv4 address Framed-Pool (88)
ipv6-wan its own IPv6 /64 for the access link; the WAN address is prefix::1 Framed-IPv6-Pool (100)
ipv6-pd a delegated IPv6 prefix of the pool's delegation length Delegated-IPv6-Prefix-Pool (171)

Each family is independent, and a static address from AAA always wins over a pool for its family — so a subscriber can have a static IPv6 prefix and a dynamic IPv4 address, or be IPv6-only.

Locally-defined subscribers name pools with ipv4-pool, ipv6-wan-pool and ipv6-pd-pool, or inherit subscribers default-pools.

Running several appliances with the same pool#

Configure the same pool name on every appliance, and give each appliance its own subnets. Your RADIUS profile only ever carries the name, so it does not need to know which appliance a subscriber will land on.

# lns1
set address-pool res-v4 family ipv4
set address-pool res-v4 vrf internet
set address-pool res-v4 announce 100.70.0.0/22

# lns2
set address-pool res-v4 family ipv4
set address-pool res-v4 vrf internet
set address-pool res-v4 announce 100.70.4.0/22

Appliances do not coordinate. If two appliances announce overlapping subnets, return traffic is split between them — the Address Pools page in the web UI warns when it sees that across your fleet.

Announcing into BGP#

A subnet with announce set is originated into BGP as one aggregate in the pool's VRF. The per-subscriber routes inside any pool subnet are never advertised, whether the subnet is announced or not — so BGP carries one prefix per subnet, not one per subscriber. A subnet without announce is not advertised at all; route it to the appliance some other way.

Pools and CGN#

Bind a VRF to on-box CGN with set routing vrf <vrf> cgn-ip-group <group> (or set cgn default-vrf-ip-group <group> for the default table). Every subscriber whose IPv4 lands in that VRF is translated. The VRF's IPv4 pools are then private: they cannot be announced, and you can configure the same private subnets on every appliance, because translation happens locally. IPv6 pools in the same VRF are not translated and follow their own announce setting.

Every address of a CGN public subnet is used, including the first and the last. A public subnet is routed to the appliance as a block, not configured on a link, so its network and broadcast addresses (.0 and .15 of a /28) are ordinary addresses and subscribers are translated to them. That is correct, and it is what you are paying for; but some networks and some websites still mistreat addresses ending in .0 or .255. There is no setting to exclude an address from a public subnet. If you want to avoid one, list the subnet as the smaller subnets that leave it out: 203.0.113.0/28 without .0 and .15 is 203.0.113.1/32, 203.0.113.2/31, 203.0.113.4/30, 203.0.113.8/30, 203.0.113.12/31, 203.0.113.14/32.

VRFs#

A pool belongs to one VRF. When AAA names no VRF, the subscriber goes into the pool's VRF. When AAA names a different VRF, or a subscriber's pools are in different VRFs, the subscriber is rejected.

When a pool runs out#

The family whose pool is empty is left out and the subscriber comes up on the others; a subscriber left with no address at all is rejected. The address-pool.exhausted alarm is raised straight away, and address-pool.high warns at 90% utilisation.

An IPoE line keeps its IPv6 for a day#

When an IPoE subscriber's session ends — lease expiry, an operator's disconnect, a line change — its IPv6 WAN /64 and delegated prefix are not returned to the pool. They stay held for that circuit for protocols ipoe ipv6-reservation-hours (default 24; 0 turns it off): nobody else is given them, and when the circuit connects again it gets the same ones, so the devices behind the CPE keep the addresses they took from the prefix. The hold survives a control-plane restart. It is dropped when the circuit is next given addresses from a different pool or VRF, and when it lapses.

Held blocks count as used. Size IPv6 pools for a day of held blocks: when every free block is held, a new subscriber is refused IPv6 (address-pool.exhausted) rather than given someone else's prefix. show address-pools shows the held count beside the used count, and the address-pool.held alarm is raised when a pool is over 90% used and part of that is held blocks. IPv4 and PPP sessions are not held; their addresses go back to the pool as before.

Each physical circuit (port, S-VLAN, C-VLAN) holds at most one block per pool, however many identities a CPE presents on it. Setting ipv6-reservation-hours 0 releases every hold at the commit; lowering it shortens the holds already made.

To see and release holds by hand (operator role; every release is logged):

show address-pools reservations [<pool>]
request address-pools clear-reservations <pool> [owner <owner> | prefix <prefix>]
request address-pools clear-reservations all

The web UI's Address Pools page has a Release held button on each pool that holds blocks.

Changing pools on a live appliance#

Pool changes take effect on commit. Adding subnets or exclusions keeps every existing allocation. Removing a subnet disconnects the subscribers holding addresses in it — check show address-pools <name> before you commit, and consider commit confirmed.

A renewal when the appliance has lost the session#

If the appliance no longer has a session for a circuit — after a restart that could not restore it, or after the session was cleared — the subscriber's next DHCP renewal re-creates it with the same address. This applies to DHCPv4 (renew, rebind, and a rebooted client asking for its old address) and to DHCPv6 (renew and rebind, for the address and the delegated prefix), for lines and for guest sessions alike.

The address is given back when the circuit is still authorised for the pool it comes from, the address is not excluded and nobody else has been given it, and it is the address the appliance last recorded for that circuit (if it has a record). Otherwise the renewal is refused in the usual way — a DHCPv4 NAK, a DHCPv6 NoBinding — and the client starts again and is given a new address.

So a lost session costs a subscriber at most the time to their next renewal — half the lease — and no change of address. A shorter protocols ipoe lease-seconds shortens that wait (and raises the renewal rate; see below). The lease must be between 60 and 604800 seconds.

A circuit the appliance has no record of at all can ask for any free address in its own pool and will be given it. It cannot take an address in use, or one outside its pool.

DHCPv6 renew time and the IPoE lease#

A DHCPv6 client renews at T1. Left automatic (protocols dhcp ipv6-renew-time 0), T1 is half of protocols ipoe lease-seconds — the DHCPv4 lease IPoE clients are given — and never more than half the preferred lifetime, so both families notice a lost session at about the same time. Two things follow:

  • Renew load scales with the lease. With the default 3600 s lease T1 is 1800 s. With a 120 s lease T1 is 60 s, and 450 clients send about 7.5 Renews a second, each re-authorised. Set ipv6-renew-time explicitly if you want a short DHCPv4 lease without that.
  • T1 is one value for the appliance. A subscriber given a different DHCPv4 lease by a DHCP option override still gets the global T1.

These settings are read when the control plane starts; a commit that changes one says so.

Accounting#

Accounting Start, Interim and Stop records carry the subscriber's IPv4 address, IPv6 WAN address, WAN /64 and delegated prefix, and name the pools they came from (Framed-Pool, Framed-IPv6-Pool, Delegated-IPv6-Prefix-Pool over RADIUS). When a dual-stack IPoE subscriber's second address family comes up after the Start, an Interim-Update is sent immediately.

Seeing what is allocated#

  • show address-pools and show address-pools <name> in the CLI
  • BNG → Address Pools in the web UI
  • GET /api/v1/address-pools and GET /api/v1/address-pools/{name}/allocations
  • bngAddressPoolTable in NETAVO-BNG-MIB

All figures are the appliance's own share of each pool.