Point-to-Point Protocol over Ethernet (PPPoE) is a network protocol used to encapsulate PPP frames inside Ethernet frames.
As customers deploy ADSL, they must support PPP-style authentication and authorisation over a large installed base of legacy bridging customer premises equipment (CPE). PPPoE provides the ability to connect a network of hosts over a simple bridging access device to a remote access concentrator or aggregation concentrator. With this model, each host uses its own PPP stack, thus presenting the user with a familiar user interface. Access control, billing, and type of service can be done on a per-user, rather than a per-site, basis.
As specified in RFC 2516, PPPoE has two distinct stages: a discovery stage and a session stage. When a host initiates a PPPoE session, it must first perform discovery to identify which server can meet the client’s request, and then identify the Ethernet MAC address of the peer and establish a PPPoE session id. While PPP defines a peer-to-peer relationship, discovery is inherently a client-server relationship.
PPPoE Configuration
The following sections cover server (ISP premises) and client PPPoE configurations. I’ve included them because the CCNA syllabus now mandates that you know how to configure PPPoE!
Server Configuration
The first step in creating the PPPoE server configuration is to define a BBA (broadband aggregation) group which will manage the incoming connections. This BBA group must be associated to a virtual template:
Router(config)#bba-group pppoe GROUP
Router(config-bba-group)#virtual-template 1
The next step is to create a virtual template for the customer-facing interface. On the virtual template you need to configure an IP address and a pool of addresses from which clients are assigned a negotiated address:
Router(config)#interface virtual-template 1
Router(config-if)#ip address 10.10.10.1 255.255.255.0
Router(config-if)#peer default ip address pool POOL
The IP pool is defined in global configuration mode. This is similar to a DHCP pool configuration:
Router(config)#ip local pool POOL 10.10.10.2 10.10.10.254
The final step is to enable the PPPoE group on the customer-facing interface:
Router(config)#interface FastEthernet0/0
Router(config-if)#no ip address
Router(config-if)#pppoe enable group GROUP
Router(config-if)#no shutdown
Client Configuration
On the client side a dialer interface has to be created. This will manage the PPPoE connection. The dialer interface can be assigned a manual IP address or can be instructed to request one from the server ( using the ip address negotiated command):
Router(config)#interface dialer1
Router(config-if)#dialer pool 1
Router(config-if)#encapsulation ppp
Router(config-if)#ip address negotiated
Router(config)#interface FastEthernet0/0
Router(config-if)#no ip address
Router(config-if)#pppoe-client dial-pool-number 1
Router(config-if)#no shutdown
Authentication
In order to secure the PPPoE connection, you can use two methods:
- PAP (Password Authentication Protocol) – insecure, sends the credentials (both username and password) in plain text
- CHAP (Challenge Handshake Authentication Protocol) – secure (clear text username and MD5 hashed password), the preferred method
PAP can be configured as follows:
Server(config)#username Client password Password
Server(config)#interface virtual-template 1
Server(config-if)#ppp authentication pap
Server(config-if)#ppp pap sent-username Server password Password
Client(config)#username Server password Password
Client(config)#interface dialer 1
Client(config-if)#ppp authentication pap
Client(config-if)#ppp pap sent-username Client password Password
CHAP can be configured as follows:
Server(config)#username Client password Password
Server(config)#interface virtual-template 1
Server(config-if)#ppp authentication chap
Client(config)#username Server password Password
Client(config)#interface dialer 1
Client(config-if)#ppp authentication chap
PPPoE Verification and Troubleshooting
The following message appears on the client console after the PPPoE session has successfully formed:
%DIALER-6-BIND: Interface Vi1 bound to profile Di1
%LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to up
The following command can be used on the client router to verify the dialer interface obtained (negotiated) and the IP address from the PPPoE server:
Router#show ip interface brief
Interface IP-Address OK? Method Status Protocol
Virtual-Access1 unassigned YES unset up/up
Dialer1 10.10.10.2 YES IPCP up/up
The following command can be used on the client router to show the PPPoE session status:
Router#show pppoe session
1 client session
Uniq ID PPPoE RemMAC Port Source VA State
SID LocMAC VA-st
N/A 16 ca00.4843.0008 Fa0/0 Di1 Vi1 UP
ca01.4843.0008 UP
Useful troubleshooting commands for PPPoE connections are as follows:
Router#debug ppp ?
authentication CHAP and PAP authentication
bap BAP protocol transactions
cbcp Callback Control Protocol negotiation
elog PPP ELOGs
error Protocol errors and error statistics
forwarding PPP layer 2 forwarding
mppe MPPE Events
multilink Multilink activity
negotiation Protocol parameter negotiation
packet Low-level PPP packet dump