Broadband Access

⚠️ Modernization Notice These notes were written in 2018–2019. IPv6 CPE and OS support, DHCPv6 implementations, and ISP best practices have evolved significantly since then. Treat this as a record of real testing and the architectural decisions behind it, and validate against current RFCs, CPE datasheets, and OS release notes before deploying in production. Overview This post brings together two pieces of work I did on IPv6 for PPP broadband. The first is a set of notes and lab tests on running a single dual-stack PPP session per subscriber and assigning IPv6 prefixes to the CPE from a Cisco IOS XE BNG. The second is a design sketch for assigning static IPv6 prefixes per customer from a RADIUS/AAA backend. They belong together: the lab work shows how Cisco ISG/IOS XE actually behaves when prefixes arrive over RADIUS, and the design sketch is the natural next step once you decide that static, per-customer prefixes are what you want. ...

⚠️ Modernization Notice This post was written in 2018 against Cisco IOS XE / ISG on the ASR 1000. Behavior around parameterized QoS, CoA, and policy-map chaining has changed across releases. Treat the configs and outputs here as a record of what I tested at the time, and validate against the current IOS XE configuration guides before deploying. Overview On the ASR 1000 (and IOS XE in general) there are broadly two ways to apply QoS to subscriber sessions: per-session and per-flow. They cannot be applied at the same time on the same session, so the first decision is which model fits your service. ...

⚠️ Modernization Notice This post is based on notes I took in 2018 against Cisco IOS XE / ISG on the ASR 1000. The VRF placement rules and the MPLS-VPN restriction described here reflect the behavior I observed at the time. Treat the specifics as a record of what I tested, and validate against the current IOS XE ISG configuration guides before deploying. Background On the ASR 1000, ISG (Intelligent Services Gateway) handles subscriber web logon — the “captive portal” experience where an unauthenticated subscriber’s HTTP traffic is intercepted and redirected to a login or service-selection portal. Two ISG features work together to make this happen: ...