Onboarding: DHCP and AAA are one act

In an ordinary network, DHCP and authentication are separate systems that do not know about each other. In a BNG they cannot be — the address you hand out, the decision to admit the subscriber, and the programming of the data plane must be a single coordinated act. That is why the BNG embeds its own DHCP server inside the controller rather than relaying to an external one.

The onboarding handshake, at operator altitude, runs like this:

1. A new subscriber's DHCP Discover reaches the BNG (relayed by the edge router, carrying Option 82). It matches no session, so it is punted to the controller. → AUTHENTICATING
2. The controller authenticates the subscriber with AAA, using the identifiers it has (Option 82 circuit/remote IDs, the subscriber's MAC, the edge router identity).
3. On accept, the controller resolves the service plan (the rates), allocates an IP from a pool (or uses one AAA specified), programs the data plane with the new session, arms an offer-expiry timer, and sends the DHCP Offer. → OFFERING
4. The subscriber replies with a DHCP Request to confirm. The controller creates the lease, starts accounting, arms the session timers, and sends the DHCP Ack. → CONNECTED

From that moment the subscriber is in the fast path and the controller sees nothing more of them until a renewal, a release, a timer, or a policy change.

On a reject — AAA cannot identify the subscriber — the BNG does not simply drop them. It assigns an address, programs the session with the captive flag on, and offers the lease anyway, landing the subscriber directly in CAPTIVE so they can reach the portal and sign up.

A note on pools and addresses. Address pools are simple: each is just a range and a lease time. A single subscriber pool is recommended for most operators. There is deliberately no "captive pool" — captive is a property of the session, not of the address range, so a subscriber keeps the same IP whether they are connected or behind the portal. Multiple pools are supported only for address-management convenience (region, scale), never to separate captive from full-access subscribers.