PPP authentication is optional with PPP. Authentication protocols supported are: Password
Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP) and Microsoft
CHAP (version 1 and 2). If authentication is used, at least one of the peers has to authenticate
itself before the network layer protocol parameters can be negotiated using NCP. During the LCP
and NCP negotiation, optional parameters such as encryption, can be negotiated.
PPPoE Client Configuration
It is possible to run the NetDefendOS PPPoE client over either a physical Ethernet interface or a
VLAN interface.
Each PPPoE tunnel is interpreted as a logical interface by NetDefendOS, with the same routing
and configuration capabilities as regular interfaces and with IP rules being applied to all traffic.
Network traffic arriving at the firewall through the PPPoE tunnel will have the PPPoE tunnel
interface as its source interface. For outbound traffic, the PPPoE tunnel interface will be the
destination interface.
As with any interface, one or more routes are defined so NetDefendOS knows what IP addresses
it should accept traffic from and which to send traffic to through the PPPoE tunnel. The PPPoE
client can be configured to use a service name to distinguish between different servers on the
same network.
IP address information
PPPoE uses automatic IP address allocation which is similar to DHCP. When NetDefendOS
receives this IP address information from the ISP, it stores it in a network object and uses it as the
IP address of the interface.
User authentication
If user authentication is required by the ISP, the username and password can be setup in
NetDefendOS for automatic sending to the PPPoE server.
Dial-on-demand
If dial-on-demand is enabled, the PPPoE connection will only be up when there is traffic on the
PPPoE interface. It is possible to configure how the firewall should sense activity on the interface,
either on outgoing traffic, incoming traffic or both. Also configurable is the time to wait with no
activity before the tunnel is disconnected.
Unnumbered PPPoE
When NetDefendOS acts as a PPPoE client, support for unnumbered PPPoE is provided by default.
The additional option also exists to force unnumbered PPPoE to be used in PPPoE sessions.
Unnumbered PPPoE is typically used when ISPs want to allocate one or more preassigned IP
addresses to users. These IP addresses are then manually entered into client computers. The ISP
does not assign an IP address to the PPPoE client at the time it connects.
A further option with the unnumbered PPPoE feature in NetDefendOS is to allow the
specification of a single IP address which is used as the address of the PPPoE client interface. This
address can serve the following purposes:
• The IP address specified will be sent to the PPPoE server as the "preferred IP". If unnumbered
PPPoE is not forced, the server may choose to not accept the preferred IP and instead assign
another IP address to the PPPoE client.
Chapter 3: Fundamentals
203
To Next Page
Loading...
