[Subscriber Management] RADIUS CoA execution may fail if two CoA messages for same subscriber are received in quick succession

Summary:

This article gives a possible reason for RADIUS Change of Authorization (CoA) execution failure on MX broadband network gateway (BNG), and provides a recommendation on how the issue can be resolved.

Symptoms:

Customers may find that when a Change of Authorization (CoA) request message is received on the MX broadband network gateway (BNG), it is not executed nor is a CoA NAK sent in response.

Further, a CoA "Execution failure" error is seen in the authd traceoptions such as that shown below:

Example

May 13 13:29:04.266232 dynamicRequestDecode:4290 Dynamic request decode - proceed to queue the request
May 13 13:29:04.266242 smmProcDynReq:1275 Dynamic request decode  cause(0), error(), reason(0), status(35)
May 13 13:29:04.266304 smmQueueDynReq: coa-req non-family request in progress, session-id:2095639
May 13 13:29:04.266317 setDynamicProfileUpdateFailCause: dynamicProfileUpdateResult 5
May 13 13:29:04.266326 setDynamicProfileUpdateErrorMsg:5938 dynamicProfileUpdateErrorMsg: 122 Execution failure
May 13 13:29:04.266335 smmProcDynReq: coa-req: failed to queue, session-id:2095639

Cause:

In this particular example, the CoA "execution failure" is caused by two CoA messages that were received in quick succession. The second CoA request for the same subscriber session arrived when the first CoA request was still being processed, thus resulting in "execution failure" for the second CoA request.

May 13 13:29:04.211366 Parsing RADIUS message for session-id:2095639
May 13 13:29:04.211391 radius-coa-request: IPv6-Ingress-Policy-Name (Juniper-ERX-VSA) received: PreACL6
May 13 13:29:04.211406 radius-coa-request: IPv6-Egress-Policy-Name (Juniper-ERX-VSA) received: PreACL6
May 13 13:29:04.211421 radius-coa-request: Activate-Service (Juniper-ERX-VSA) received: Tag (2) redirect-v6
<<< The interval between the two CoA messages is only about 0.05 seconds. >>>
May 13 13:29:04.266009 Parsing RADIUS message for session-id:2095639
May 13 13:29:04.266029 radius-coa-request: IPv6-Ingress-Policy-Name (Juniper-ERX-VSA) received: Open6-I
May 13 13:29:04.266044 radius-coa-request: IPv6-Egress-Policy-Name (Juniper-ERX-VSA) received: Open6-O
May 13 13:29:04.266057 radius-coa-request: Deactivate-Service (Juniper-ERX-VSA) received: redirect-v6

Solution:

This issue is caused by the CoA client (a third-party vendor device). To resolve the issue, it is recommended to have a delay of at least one second between two CoA requests for the same subscriber session.

Knowledge Base