ASR 9001 BNG IPoE problems

Question

Hi,
I have read and try these guides
https://supportforums.cisco.com/docs/DOC-23170
https://supportforums.cisco.com/docs/DOC-19702
https://supportforums.cisco.com/docs/DOC-19726
But have some problems , here is my config ( almost same like the guides )
radius-server host xxx.xxx.xxx.46 auth-port 1812 acct-port 1813!aaa server radius dynamic-author port 3799 client yyy.yyy.yyy.102 vrf default ! client xxx.xxx.xxx.46 vrf default !aaa attribute format MY_AUTH mac-address! aaa attribute format NAS_PORT_FORMAT circuit-id plus remote-id separator .!!aaa radius attribute nas-port format e SSAAPPPPQQQQQQQQQQVVVVVVVVVVUUUU type 32aaa radius attribute nas-port format e SSAAPPPPQQQQQQQQQQVVVVVVVVVVUUUUaaa radius attribute nas-port-id format NAS_PORT_FORMATaaa group server radius RADIUS_GR server xxx.xxx.xxx.46 auth-port 1812 acct-port 1813 source-interface Loopback0!aaa authorization network default group RADIUS_GRaaa accounting subscriber default group RADIUS_GRaaa authorization subscriber AUTH_GR group RADIUS_GRaaa authorization subscriber default group RADIUS_GRaaa authorization subscriber RADIUS_GR group RADIUS_GRaaa authentication subscriber default group RADIUS_GRaaa accounting update periodic 10dhcp ipv4 profile IP_DEFAULT proxy  class IP_DEFAULT   helper-address vrf default yyy.yyy.yyy.102 giaddr zzz.zzz.zzz.1  !  helper-address vrf default yyy.yyy.yyy.102 giaddr zzz.zzz.zzz.1  relay information option  relay information policy keep  relay information option allow-untrusted !   interface Bundle-Ether100.361 proxy profile IP_DEFAULT!ipv4 access-list PERM_ALL 10 permit ipv4 any any 20 permit icmp any any 30 permit ipv4 any any!interface Bundle-Ether100 bundle load-balancing hash dst-ip!!interface Bundle-Ether100.361 ipv4 point-to-point ipv4 unnumbered Loopback100 service-policy type control subscriber IP_PM encapsulation dot1q 361 ipsubscriber ipv4 l2-connected  initiator dhcp !!interface Loopback0 ipv4 address ccc.ccc.ccc.174 255.255.255.255!interface Loopback100 description 4dhcp ipv4 address zzz.zzz.zzz.1 255.255.255.0!interface TenGigE0/0/2/0 bundle id 100 mode on!interface TenGigE0/0/2/1!dynamic-template type ipsubscriber IPSUB_TPL  ipv4 unnumbered Loopback100  ipv4 access-group PERM_ALL ingress  ipv4 access-group PERM_ALL egress !class-map type control subscriber match-any DHCP match protocol dhcpv4 end-class-map!policy-map type control subscriber IP_PM event session-start match-first  class type control subscriber DHCP do-until-failure   5 activate dynamic-template IPSUB_TPL   10 authorize aaa list AUTH_GR format MY_AUTH password cisco  ! ! end-policy-map!
Without  service-policy type control subscriber IP_PM on the interface , CPE gets ip address and all works.
The radius server is configured always to autothenticate with access-accept but there are errors
  Total Deadtime: 0s Last Deadtime: 0s
  Timeout: 5 sec, Retransmit limit: 3
  Quarantined: No
  Authentication:
    468 requests, 1 pending, 154 retransmits
    0 accepts, 0 rejects, 0 challenges
    204 timeouts, 417 bad responses, 417 bad authenticators
    0 unknown types, 417 dropped, 0 ms latest rtt
    Throttled: 0 transactions, 0 timeout, 0 failures
    Estimated Throttled Access Transactions: 0
    Maximum Throttled Access Transactions: 0
  The most strange issue is this
000c.42a8.71e2  0.0.0.0         INIT       57         BE100.361            default    0x0      
and
RP/0/RSP0/CPU0:Sep 23 17:08:03.507 : dhcpd[1077]: DHCPD ERROR: TP2468: rib route delete failed, null ifhandle or IPv4 address
Here is the subscriber session info
RP/0/RSP0/CPU0:ASR9001#show subscriber session all
Mon Sep 23 17:08:46.995 EET
Codes: IN - Initialize, CN - Connecting, CD - Connected, AC - Activated,
       ID - Idle, DN - Disconnecting, ED - End
Type         Interface                State     Subscriber IP Addr / Prefix                             
                                                LNS Address (Vrf)                             
IP:DHCP      No                       CN        -                                   
RP/0/RSP0/CPU0:ASR9001#show subscriber session all detail
Mon Sep 23 17:08:48.394 EET
Interface:                None
Circuit ID:               000401690107
Remote ID:                0006001ebd7b2f00
Type:                     IP: DHCP-trigger
IPv4 State:               Up Pending, Mon Sep 23 17:08:32 2013
Mac Address:              000c.42a8.71e2
Account-Session Id:       000001e0
Nas-Port:                 67114640
User name:                unknown
Outer VLAN ID:            361
Subscriber Label:         0x0000005f
Created:                  Mon Sep 23 17:08:32 2013
State:                    Connecting
Authentication:           unauthenticated
Access-interface:         Bundle-Ether100.361
Policy Executed:
policy-map type control subscriber IP_PM
  event Session-Start match-first [at Mon Sep 23 17:08:32 2013]
    class type control subscriber DHCP do-until-failure [Succeeded]
      5 activate dynamic-template IPSUB_TPL [Succeeded]
Session Accounting: disabled
Last COA request received: unavailable
Pending Callbacks:
  Waiting for Authorization to complete
  Waiting for Authentication response from AAA

Answer 1

Hi Alex, i have downgrade my router to 4.3.4, in this version there are no DHCPv4 Server option. how do i get the dhcp server in my router ?
I have try to connect my demo client, the result is my router doesn't recieved Accept-Access from my Radius and also the routing system still send radius packet from interface physical instead loopback0.
Access-Request from Router to Radius #  7 09:45:02.753 : radiusd[315]:  RADIUS: Send Access-Request to 202.xxx.xxx.60:1645 id 24, len 254  7 09:45:02.754 : radiusd[315]:  RADIUS:  authenticator FC 30 00 B2 EB 76 ED 27 - 82 51 DF 8C F2 45 AA 6F  7 09:45:02.754 : radiusd[315]:  RADIUS:  Vendor,Cisco        [26]    41        7 09:45:02.754 : radiusd[315]:  RADIUS:   Cisco AVpair        [1]    35      client-mac-address=000f.b0d1.a219  7 09:45:02.754 : radiusd[315]:  RADIUS:  Vendor,Cisco        [26]    34        7 09:45:02.754 : radiusd[315]:  RADIUS:   Cisco AVpair        [1]    28      dhcp-vendor-class=MSFT 5.0  7 09:45:02.754 : radiusd[315]:  RADIUS:  Acct-Session-Id     [44]    10      0400000a  7 09:45:02.754 : radiusd[315]:  RADIUS:  NAS-Port-Id         [87]    13      130/8/0/905  7 09:45:02.754 : radiusd[315]:  RADIUS:  Vendor,Cisco        [26]    19        7 09:45:02.754 : radiusd[315]:  RADIUS:   cisco-nas-port      [2]    13      130/8/0/905  7 09:45:02.754 : radiusd[315]:  RADIUS:  User-Name           [1]     16      000f.b0d1.a219  7 09:45:02.754 : radiusd[315]:  RADIUS:  Service-Type        [6]     6       Outbound[5]   7 09:45:02.754 : radiusd[315]:  RADIUS:  User-Password       [2]     18      *         7 09:45:02.754 : radiusd[315]:  RADIUS:  Vendor,Cisco        [26]    33        7 09:45:02.754 : radiusd[315]:  RADIUS:   Cisco AVpair        [1]    27      parent-if-handle=67111360  7 09:45:02.754 : radiusd[315]:  RADIUS:  NAS-Port-Type       [61]    6       IPOEOVLAN[40]   7 09:45:02.754 : radiusd[315]:  RADIUS:  Event-Timestamp     [55]    6       1389062702  7 09:45:02.754 : radiusd[315]:  RADIUS:  Nas-Identifier      [32]    26      HOSTNAME-BNG  7 09:45:02.754 : radiusd[315]:  RADIUS:  NAS-IP-Address      [4]     6      210.xxx.yyy.2Access-Request from Radius which got from Router #*** Received from 210.xxx.yyy.2 port 51185 ....Code:       Access-RequestIdentifier: 31Authentic:  *<134><174><25><251>a<140><17><170><255>S<191><205>;T<153>Attributes: cisco-avpair = "client-mac-address=000f.b0d1.a219" cisco-avpair = "dhcp-vendor-class=MSFT 5.0" Acct-Session-Id = "0400000b" NAS-Port-Id = "130/8/0/905" Cisco-NAS-Port = "130/8/0/905" User-Name = "000f.b0d1.a219" Service-Type = 5 User-Password = <251><10>h<203><11><203><151><132>i<29><222>@<251>t7<166> cisco-avpair = "parent-if-handle=67111360" NAS-Port-Type = 40 Event-Timestamp = 1389062760 NAS-Identifier = "HOSTNAME-BNG" NAS-IP-Address = 210.xxx.yyy.2##Accept-Access from Radius to Router ##Tue Jan  7 09:42:53 2014: DEBUG: Handling with Radius::AuthFILE: Tue Jan  7 09:42:53 2014: DEBUG: Radius::AuthFILE looks for match with 000f.b0d1.a219 [000f.b0d1.a219]Tue Jan  7 09:42:53 2014: DEBUG: Radius::AuthFILE ACCEPT: : 000f.b0d1.a219 [000f.b0d1.a219]Tue Jan  7 09:42:53 2014: DEBUG: AuthBy FILE result: ACCEPT, Tue Jan  7 09:42:53 2014: DEBUG: Access accepted for 000f.b0d1.a219Tue Jan  7 09:42:53 2014: DEBUG: Packet dump:*** Sending to 210.xxx.yyy.2 port 51185 ....Code:       Access-AcceptIdentifier: 31Authentic:  $U<226><252>4<219><171><228><226>q^<28><135>?<143><175>Attributes:## BUT The Router never recieved Access-Accept Packet from the Radius ##== Current Configuration After Downgrade to 4.3.4 ==radius source-interface Loopback0 vrf defaultradius-server host 202.158.58.60 auth-port 1645 acct-port 1646 key 7 radius-server timeout 10aaa attribute format NAS_PORT_FORMAT circuit-id plus remote-id separator #!aaa attribute format USERNAME_FORMAT mac-addressaaa group server radius radiator server 202.xx.xx.60 auth-port 1645 acct-port 1646 source-interface Loopback0!aaa accounting subscriber default group radiatoraaa authorization subscriber default group radiatoraaa authorization subscriber author_grp group radiatoraaa authentication subscriber default group radiatoraaa accounting update periodic 5dhcp ipv4 profile DHCPv4 proxy  helper-address vrf default 202.xxx.1.34 giaddr 101.aaa.bbb.1  relay information option  relay information policy keep  relay information option allow-untrusted interface GigabitEthernet0/0/0/0.905 proxy profile DHCPv4interface Loopback0 ipv4 address 202.ccc.ddd.233 255.255.255.255interface Loopback2000 ipv4 address 101.aaa.bbb.1 255.255.255.0interface GigabitEthernet0/0/0/0.905 ipv4 point-to-point ipv4 unnumbered Loopback2000 service-policy type control subscriber IP_PM encapsulation dot1q 905 ipsubscriber ipv4 l2-connected  initiator dhcp  initiator unclassified-source  dynamic-template type ipsubscriber IPSUB_TPL  ipv4 unnumbered Loopback2000 !!class-map type control subscriber match-any IP_SUB match protocol dhcpv4 dhcpv6 end-class-map!policy-map type control subscriber IP_PM event session-start match-first  class type control subscriber IP_SUB do-all   10 activate dynamic-template IPSUB_TPL   20 authorize aaa list author_grp format USERNAME_FORMAT password iosxr  ! ! event account-logon match-first  class type control subscriber IP_SUB do-all   10 authenticate aaa list default  ! ! end-policy-map#Radius Status#show radius Tue Jan  7 09:56:52.137 GMTGlobal dead time: 0 minute(s)Number of Servers:1Server: 202.xx.xx.60/1645/1646  is UP  Total Deadtime: 0s Last Deadtime: 0s   Timeout: 10 sec, Retransmit limit: 3  Quarantined: No   Authentication:    11 requests, 1 pending, 31 retransmits    0 accepts, 0 rejects, 0 challenges    41 timeouts, 0 bad responses, 0 bad authenticators    0 unknown types, 0 dropped, 0 ms latest rtt    Throttled: 0 transactions, 0 timeout, 0 failures    Estimated Throttled Access Transactions: 0     Maximum Throttled Access Transactions: 0     Automated TEST Stats:        0 requests, 0 timeouts, 0 response, 0 pending  Accounting:    0 requests, 0 pending, 0 retransmits    0 responses, 0 timeouts, 0 bad responses    0 bad authenticators, 0 unknown types, 0 dropped    0 ms latest rtt    Throttled: 0 transactions, 0 timeout, 0 failures    Estimated Throttled Accounting Transactions: 0     Maximum Throttled Accounting Transactions: 0    Automated TEST Stats:        0 requests, 0 timeouts, 0 response, 0 pending