Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[Subscriber Management] RADIUS CoA execution may fail if two CoA messages for same subscriber are received in quick succession

0

0

Article ID: KB34445 KB Last Updated: 31 May 2019Version: 1.0
Summary:

This article gives a possible reason for RADIUS Change of Authorization (CoA) execution failure on MX broadband network gateway (BNG), and provides a recommendation on how the issue can be resolved.

 

Symptoms:

Customers may find that when a Change of Authorization (CoA) request message is received on the MX broadband network gateway (BNG), it is not executed nor is a CoA NAK sent in response.

Further, a CoA "Execution failure" error is seen in the authd traceoptions such as that shown below:

Example

May 13 13:29:04.266232 dynamicRequestDecode:4290 Dynamic request decode - proceed to queue the request
May 13 13:29:04.266242 smmProcDynReq:1275 Dynamic request decode  cause(0), error(), reason(0), status(35)
May 13 13:29:04.266304 smmQueueDynReq: coa-req non-family request in progress, session-id:2095639
May 13 13:29:04.266317 setDynamicProfileUpdateFailCause: dynamicProfileUpdateResult 5
May 13 13:29:04.266326 setDynamicProfileUpdateErrorMsg:5938 dynamicProfileUpdateErrorMsg: 122 Execution failure
May 13 13:29:04.266335 smmProcDynReq: coa-req: failed to queue, session-id:2095639

 

Cause:

In this particular example, the CoA "execution failure" is caused by two CoA messages that were received in quick succession. The second CoA request for the same subscriber session arrived when the first CoA request was still being processed, thus resulting in "execution failure" for the second CoA request.

May 13 13:29:04.211366 Parsing RADIUS message for session-id:2095639
May 13 13:29:04.211391 radius-coa-request: IPv6-Ingress-Policy-Name (Juniper-ERX-VSA) received: PreACL6
May 13 13:29:04.211406 radius-coa-request: IPv6-Egress-Policy-Name (Juniper-ERX-VSA) received: PreACL6
May 13 13:29:04.211421 radius-coa-request: Activate-Service (Juniper-ERX-VSA) received: Tag (2) redirect-v6
<<< The interval between the two CoA messages is only about 0.05 seconds. >>>
May 13 13:29:04.266009 Parsing RADIUS message for session-id:2095639
May 13 13:29:04.266029 radius-coa-request: IPv6-Ingress-Policy-Name (Juniper-ERX-VSA) received: Open6-I
May 13 13:29:04.266044 radius-coa-request: IPv6-Egress-Policy-Name (Juniper-ERX-VSA) received: Open6-O
May 13 13:29:04.266057 radius-coa-request: Deactivate-Service (Juniper-ERX-VSA) received: redirect-v6

 

Solution:

This issue is caused by the CoA client (a third-party vendor device). To resolve the issue, it is recommended to have a delay of at least one second between two CoA requests for the same subscriber session.

 

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search