Configuring PBR to a PPPoE user

To be more specific, I need a possibility to configure a PBR but need to include some exceptions with ACL. This is possible in Juniper and Cisco, but on Huawei I saw on HedEx that to PPPoE clients the only ACL possible is to match MAC Address, not IP.

I'm not sure what's your meaning, maybe you can give an example about what you wanna do.

Hello, i have the same problem...

We have similar situations that bring a heavy reliance on administrative systems for ISPs because of the imperativeness of having Radius server attributes or the use of UCL ACLs. I believe that being able to keep controls isonically on the NE20s or NE40s would be a big step towards increasing utilization of these devices rather than moving to Juniper or Cisco.

I'm facing the same problem here. I'm making the PBR outsite the NE box, because it can't do inside without a radius parameter.

@chenhui,

We need a possible to configure L3 Policies to PPPoE clients, like is possible on CISCO ASR ande JUNIPER MX. See examples on this two plataforms:

JUNIPER:
This policy is applied to all connected PPPoE users via connection template and do directions based on some conditions:

firewall {
family inet {
filter "$filter-up" {
interface-specific;
term protege-gerencia {
from {
protocol tcp;
destination-port [ 7722 7780 8728 8291 8729 ];
}
then {
discard;
}
}
term CDNs {
from {
destination-address {
186.xxx.yyy.192/26;
186.xxx.yyy.240/28;
186.xxx.yyy.0/26;
186.xxx.yyy.0/30;
186.xxx.yyy.4/30;
}
source-prefix-list {
pl-CGNAT;
}
}
then {
policer "$shaper-up";
accept;
}
}
term accept-pbr {
from {
source-prefix-list {
pl-CGNAT;
}
}
then {
policer "$shaper-up";
routing-instance VRF_CGNAT;
}
}
term accept-instala {
from {
source-prefix-list {
pl-AGUARD_INSTA;
}
}
then {
policer "$shaper-up";
routing-instance VRF_BLOQUEADO;
}
}
term accept-bloqueado {
from {
source-prefix-list {
pl-BLOQUEADO;
}
}
then {
policer "$shaper-up";
routing-instance VRF_BLOQUEADO;
}
}
term accept {
then {
policer "$shaper-up";
accept;
}
}
}
filter "$filter-down" {
interface-specific;
term accept {
then {
policer "$shaper-down";
service-filter-hit;
accept;
}
}
}
}

CISCO ASR9K
This policy do the redirect of CGNAT traffic and is applied to a Dynamic Profile to each PPPoE user:

policy-map type pbr CGNAT-POLICY
class type traffic CGNAT
redirect ipv4 nexthop 172.29.5.62
!
class type traffic class-default
transmit
!
end-policy-map
!

from the Cisco configuration, it seems that you are trying to redirect the PPPoE users' traffic?

Hello @chenhui,

I have the same issue. I want to redirect PPPoE users to a CGNAT box, just like we do with Cisco/Juniper, based on ACL (some hosts or destinations are redirected), without using radius attribute for the policy route (that redirects ALL the traffic).

Hello,

I have the same issue. I want to redirect PPPoE users to a CGNAT box, just like we do with Cisco/Juniper, based on ACL (some hosts or destinations are redirected), without using radius attribute for the policy route (that redirects ALL the traffic).