Hi Everyone,
I have a question concerning the behavior of DOCSIS frames transmitted by statically addressed cable modems.
I am trying to configure a Casa C1G to serve a statically addressed cable modem. I setup mirroring on the C1G to see the docsis traffic to/from the CM. The docsis frames containing the network traffic originating from the CPE have the CM's RF MAC address as the source instead of its WAN MAC address. When I tested with dynamically assigned CM's, the CM puts its WAN MAC, not the RF MAC as the source (as labeled on the CM boxes). It seems the Casa is dropping the packets that are using the RF MAC (not routing them).
Has anyone else seen this? Does anyone know of a solution with the C1G?
the CM MAC address is in the DHCP option 82 suboption2. This is the way it is transfered to the DHCP server.
With DHCP DISCOVER/REQUEST msg sent from cmts you'll receive option82 suboption2 with CM MAC address in it.
If you have some sort of dhcp authorization turned on, this is what will happen. Turn off dhcp authorization / dhcp leasequery and this should go away.
Using statics with RIP modems, or using SAV or adding leases to your dhcp server and using leasequery would solve this issue.
This is how you completly disable dhcp authorization on Casa CMTS
#conf
#int docsis-mac 1
# no dhcp-autorization
This is how you disable it per host:
#conf
#cable host authorization 0000.0000.0000 1.1.1.1
Hi, like kwesibrunee mentioned Source Address Verification (SAV) would be a nice option.
With SAV in the cable modem config file you can allow a static IPv4 or IPv6 Address/Scope for the CPE behind the cable modem. Even if the CMTS is allowing only dhcp for the CPE IP Addresses behind the cable modems without SAV in their config files.
Config tool: DOCSIS Configuration File creator, version 0.9.9-dev
Example for the /24 network 192.168.10.0/24:
Main
{
NetworkAccess 1;
UsServiceFlow
{
UsServiceFlowRef 1;
QosParamSetType 7;
}
DsServiceFlow
{
DsServiceFlowRef 2;
QosParamSetType 7;
}
VendorSpecific
{
VendorIdentifier 0xffffff;
SAVAuthorizationEncoding
{
SAVStaticPrefixRule
{
SAVStaticPrefixAddress 192.168.10.0;
SAVStaticPrefixLength 24;
}
}
}
}
Example for a single IPv4 Address only:
Main
{
NetworkAccess 1;
UsServiceFlow
{
UsServiceFlowRef 1;
QosParamSetType 7;
}
DsServiceFlow
{
DsServiceFlowRef 2;
QosParamSetType 7;
}
VendorSpecific
{
VendorIdentifier 0xffffff;
SAVAuthorizationEncoding
{
SAVStaticPrefixRule
{
SAVStaticPrefixAddress 192.168.10.23;
SAVStaticPrefixLength 32;
}
}
}
}
For IPv6 Scope 2001:db8::/32 for the IA_NA IPv6 Address
Main
{
NetworkAccess 1;
UsServiceFlow
{
UsServiceFlowRef 1;
QosParamSetType 7;
}
DsServiceFlow
{
DsServiceFlowRef 2;
QosParamSetType 7;
}
VendorSpecific
{
VendorIdentifier 0xffffff;
SAVAuthorizationEncoding
{
SAVStaticPrefixRule
{
SAVStaticPrefixAddress 2001:db8::;
SAVStaticPrefixLength 32;
}
}
}
}
For a single IA_NA IPv6 Address (2001:db8::1234:1/128):
Main
{
NetworkAccess 1;
UsServiceFlow
{
UsServiceFlowRef 1;
QosParamSetType 7;
}
DsServiceFlow
{
DsServiceFlowRef 2;
QosParamSetType 7;
}
VendorSpecific
{
VendorIdentifier 0xffffff;
SAVAuthorizationEncoding
{
SAVStaticPrefixRule
{
SAVStaticPrefixAddress 2001:db8::1234:1;
SAVStaticPrefixLength 128;
}
}
}
}
Please notice: You can only configure the SAV once! IPv4 or IPv6, you have to choose one option. You can not combine the SAV Options. Also SAV will only handle IA_NA IPv6 Addresses and no IA_PD Scopes!
For my knowledge Casa did support SAV very well.