PPPoE is supported on ATM PVCs only.
The Cisco 6400 cannot initiate dial-out PPPoE sessions.
PPPoE supports Cisco Express Forwarding (CEF) only. Fastswitching on PPPoE virtual-access interfaces is not supported.

PPPoA

PPPoA does not support static IP assignments within virtual templates.

PPPoA/PPPoE Autosense on ATM VC

Do not use this feature on a router that initiates PPPoA sessions.
This feature supports ATM PVCs. Switched virtual circuits (SVCs) are not supported.

PPPoE Session Count MIB

The snmp-server enable traps pppoe command enables SNMP traps only. It does not support inform requests.

Prerequisites

PPP Scalability

See the Cisco 6400 Release Notes for memory recommendations.
In order to gain maximum packet-switching performance, enable Cisco Express Forwarding (CEF) on the virtual-access interface. For information about enabling Cisco Express Forwarding, see the "Configuring Cisco Express Forwarding" chapter in the "Cisco IOS Switching Paths" part of the Cisco IOS Switching Services Configuration Guide .

PPPoE Session Count MIB

The tasks as described in the "PPPoE Session Count MIB" section assume that you have configured SNMP and PPPoE.

Basic PPPoE Configuration

Note Before performing these tasks, read the Restrictions and Prerequisites sections.

The NRP uses virtual templates to assign PPP features to a PVC. As each PPP session comes online, a virtual access interface is "cloned" from the virtual template. This virtual-access interface inherits the configuration specified in the virtual template. When the virtual template is changed, the changes are automatically propagated to all virtual-access interfaces cloned from that particular virtual template.

After you configure a virtual template for PPPoE, you must configure the PVCs that carry traffic from the NRP to the ATM interfaces. Finally, to allow PPPoE to operate over the virtual-access interface, set the IP maximum transmission unit (MTU) to 1492.

Basic PPPoE configuration consists of the following tasks:

Task 1: Configuring a Virtual Template for PPPoE

To configure a virtual template for PPPoE, complete the following steps beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)# vpdn enable`	Enables virtual private dial-up networking.
Step 2	`Router(config)# vpdn-group number`	Selects the VPDN group and enters VPDN group configuration mode.
Step 3	`Router(config-vpdn)# accept dialin pppoe virtual-template number`	Configures the router to accept dial-in PPPoE calls.
Step 4	`Router(config-vpdn)# pppoe limit per-mac number`	(Optional) Limits the number of PPPoE sessions that originate from one MAC address. Default is 100.
Step 5	`Router(config-vpdn)# pppoe limit per-vc number`	(Optional) Limits the number of PPPoE sessions that can be established on a virtual circuit. Default is 100.
Step 6	`Router(config-vpdn)# exit`	Returns to global configuration mode.
Step 7	`Router(config)# virtual-template template-number pre-clone number`	(Optional) Creates "pre-cloned" virtual-access interfaces equal to the expected maximum number of concurrent PPPoE sessions.¹

¹Instead of creating virtual-access interfaces on demand, the system can be configured to create and save a number of pre-cloned virtual-access interfaces to a private PPPoE list. This cloning procedure reduces the CPU workload while PPPoE sessions are established.

Task 2: Configuring PPPoE on the ATM Interface

To configure PPPoE on the ATM interface, complete the following steps beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)# interface atm 0/0/0 [.subinterface-number {multipoint \| point-to-point}]`	Specifies the ATM interface and optional subinterface.
Step 2	`Router(config-if)# pvc [name] vpi/vci`	Configures the PVC.
Step 3	`Router(config-atm-vc)# encapsulation aal5snap`	Configures SNAP encapsulation.
Step 4	`Router(config-atm-vc)# protocol pppoe`	Selects PPPoE as the protocol for the PVC.

You can also configure PPPoE in a VC class and apply this VC class to an ATM VC, subinterface, or interface. For information about configuring a VC classes, see the "Permanent Virtual Circuits" section in the "Basic NRP Configuration" chapter of the Cisco 6400 Software Setup Guide . Also see the "Example: PPPoE Configuration Using a VC Class" section.

Task 3: Setting the MTU

To allow PPPoE to operate over the virtual-access interface, set the maximum transmission unit (MTU) to 1492. To set the MTU, complete the following steps beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)# interface virtual-template number`	Selects the virtual-access interface to be configured.
Step 2	`Router(config-if)# mtu 1492`	Sets the MTU to 1492.

Verifying PPPoE

Step 1 Enter the show vpdn EXEC command. The output shows PPPoE session information (see Table 4-1). Confirm that the virtual-access interface status (VASt) is up.

Router# show vpdn

 
PPPOE Tunnel and Session
 
Session count: 1
 
PPPoE Session Information
SID	        RemMAC	          LocMAC	       Intf    	VASt    	OIntf	   VC
1	       0010.54db.bc38  	0050.7327.5dc3  	Vi1	     UP      	AT0/0/0	 0/40

Table 4-1: show vpdn Field descriptions

Field	Description
SID	Session ID for the PPPoE session
RemMAC	MAC address of the host
LocMAC	MAC address of the ATM interface
Intf	Virtual-access interface associated with the PPP session
VASt	State of the virtual-access interface
OIntf	Outgoing interface
VC	Virtual circuit on which PPP session flows

Step 2 Enter the show atm pvc privileged EXEC command. The last line of the output, "PPPOE enabled," confirms that PPPoE is enabled on this VC.

Router# show atm pvc 40

ATM0/0/0.2: VCD: 1, VPI: 0, VCI: 40
UBR, PeakRate: 155000
AAL5-LLC/SNAP, etype:0x0, Flags: 0xC20, VCmode: 0x0
OAM frequency: 0 second(s), OAM retry frequency: 1 second(s), OAM retry
frequency: 1 second(s)
OAM up retry count: 3, OAM down retry count: 5
OAM Loopback status: OAM Disabled
OAM VC state: Not Managed
ILMI VC state: Not Managed
InARP frequency: 15 minutes(s)
InPkts: 100, OutPkts: 51, InBytes: 4692, OutBytes: 2294
InPRoc: 48, OutPRoc: 51, Broadcasts: 0
InFast: 0, OutFast: 0, InAS: 52, OutAS: 0
OAM cells received: 0
F5 InEndloop: 0, F5 InSegloop: 0, F5 InAIS: 0, F5 InRDI: 0
F4 InEndloop: 0, F4 InSegloop: 0, F4 InAIS: 0, F4 InRDI: 0
OAM cells sent: 0
F5 OutEndloop: 0, F5 OutSegloop: 0, F5 OutRDI: 0
F4 OutEndloop: 0, F4 OutSegloop: 0, F4 OutRDI: 0
OAM cell drops: 0
Status: UP
  
PPPOE enabled.

Examples : Configuring PPPoE

This section provides the following PPPoE configuration examples:

Example: PPPoE Configuration on a PVC

In the following example, PPPoE is enabled directly on a PVC:

!
vpdn enable
!
vpdn-group 1
 accept dialin pppoe virtual-template 1
!
virtual-template 1 pre-clone 500
!
interface atm 2/0.1 multipoint
 pvc 0/60
  encapsulation aal5snap
  protocol pppoe
!
ip cef
!
interface virtual-template 1
 ip address 10.0.1.2 255.255.255.0
 mtu 1492
 ip route-cache cef
 !

Example: PPPoE Configuration Using a VC Class

In the following example, PPPoE is configured on a VC class called "users." This VC class is then applied to a particular PVC:

!
vpdn enable
!
vpdn-group 1
 accept dialin pppoe virtual-template 1
!
virtual-template 1 pre-clone 500
!
interface atm 2/0.1 multipoint
 pvc 0/60
  class users
  !
vc-class atm users
 encapsulation aal5snap
 protocol pppoe
 !
ip cef
!
interface virtual-template 1
 ip address 10.0.1.2 255.255.255.0
 mtu 1492
 ip route-cache cef
 !

Example: Concurrent PPPoE and Bridging

PPPoE can operate concurrently with bridging on an ATM interface. This allows PPPoE to operate on one or more specific traffic protocols, leaving other protocols to be bridged.

In the following example, both PPPoE and bridging are configured to operate concurrently on the same DSL link:

!
vpdn enable
!
vpdn-group 1
 accept dialin pppoe virtual-template 1
 !
virtual-template 1 pre-clone 500
!
bridge 1 protocol ieee
bridge 1 route ip
!
interface atm 2/0.1 multipoint
 bridge-group 1
 pvc 0/60
  encapsulation aal5snap
  protocol pppoe
  !
ip cef
!
interface virtual-template 1
 ip address 10.0.1.2 255.255.255.0
 mtu 1492
 ip route-cache cef
 !

Monitoring and Maintaining PPPoE

Use the following commands to monitor and maintain PPPoE:

Command	Purpose
show atm pvc	Displays ATM PVC and traffic information, including PPPoE status.
show vpdn	Displays PPPoE session information, including MAC addresses and virtual-access interfaces.
show vpdn session packet	Displays PPPoE session statistics.
show vpdn session all	Displays PPPoE session information for each session ID.
show vpdn tunnel	Displays PPPoE session count for the tunnel.

Basic PPPoA Configuration

Note Before performing these tasks, read the "Restrictions" section.

After you configure a virtual template for PPPoA, you must configure the PVCs that carry traffic from the NRP to the ATM interfaces.

While you can use a local username database for authentication, large-scale deployment of PPP user services requires the use of a central database, such as TACACS+ or RADIUS to ease the configuration burden. RADIUS or TACACS+ servers, collectively known as authentication, authorization, and accounting (AAA) servers for PPPoA (and other media), contain the per-user configuration database, including password authentication and authorization information. For more information about AAA, see the "Authentication, Authorization, and Accounting (AAA)" chapter in the Cisco IOS Security Configuration Guide.

Basic PPPoA configuration consists of the following tasks:

Task 1: Configuring a Virtual Template for PPPoA

To configure a virtual template for PPPoA, complete the following steps beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)# interface virtual-template number`	Associates a virtual template with a virtual template interface.
Step 2	`Router(config-if)# ip unnumbered fastethernet 0/0/0`	Enables IP on the interface without assigning a specific IP address.
Step 3	`router(config-if)# peer default ip address {pool [poolname] \| dhcp }`	Specifies a dynamic IP address assignment method, either from an IP address pool or a DHCP server.
Step 4	`Router(config-if)# ppp authentication {pap \| chap} [pap \| chap]`	Selects the authentication protocol and optional secondary protocol.
Step 5	`Router(config-if)# exit`	Returns to global configuration mode.
Step 6	`Router(config)# ip local pool poolname low-ip-address [high-ip-address]`	(Optional) Configures a local pool of IP addresses to be used when a remote peer connects to a point-to-point interface.
Step 7	`Router(config)# ip dhcp-server {ip-address \| name}`	(Optional) Specifies which DHCP server to use on your network.

Caution Do not use a static IP assignment within a virtual template; routing problems can occur. Always enter the ip unnumbered command when configuring a virtual template.

To configure a different class of users on the same router, provision a separate virtual template interface. You can configure up to 25 virtual templates.

Examples : Configuring a Virtual Template for PPPoA

In the following example, all PPPoA VCs (users) cloned from virtual template 1 will use CHAP authentication and will be allocated an IP address from the pool named "telecommuters" configured on the router. In addition, the local end of the PPPoA connection is running without an IP address (recommended). Instead, the IP address of the FastEthernet interface is used for addressability:

!
interface virtual-template 1
 ip unnumbered fastethernet 0/0/0
 peer default ip address pool telecommuters
 ppp authentication chap
 !
local pool telecommuters 10.36.1.1 10.36.1.254
!

In the following example, all PPPoA VCs cloned from Virtual-Template 2 use PAP authentication over CHAP and are allocated an IP address from a DHCP server:

!
interface Virtual-Template 2
 ip unnumbered fastethernet 0/0/0
 peer default ip address dhcp
 ppp authentication pap chap
 !
ip dhcp-server 10.5.20.149
!

Task 2: Configuring PPPoA on a PVC

To configure PPPoA on a PVC, complete the following steps beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)# interface atm 0/0/0 [.subinterface-number {multipoint \| point-to-point}]`	Specifies the ATM interface and optional subinterface.
Step 2	`Router(config-if)# pvc [name] vpi/vci`	Configures a new ATM PVC by assigning a name (optional) and VPI/VCI numbers.
Step 3	`Router(config-if-atm-vc)# encapsulation aal5mux ppp virtual-Template number`	Configures the ATM adaptation layer (AAL) and encapsulation type, and configures a PVC to use a virtual-template as the default PPP interface configuration.

You can also configure PVCs by using VC classes and PVC discovery. For more information, see the "Permanent Virtual Circuits" section in the "Basic NRP Configuration" chapter of the Cisco 6400 Software Setup Guide .

Task 3: Configuring Authentication

To configure authentication for PPPoA, see the "PPP Authentication" section.

Example: Basic PPPoA Configuration

The following example shows a typical PPPoA configuration using a RADIUS authentication server:

!
interface virtual-template 1
 ip unnumbered fastethernet 0/0/0
 peer default ip address pool telecommuters
 ppp authentication chap
 !
ip local pool telecommuters 10.36.1.1 10.36.1.254
!
aaa new-model
aaa authentication ppp default radius
radius-server host 172.31.5.96
radius-server key foo
radius-server attribute nas-port format d
!
interface atm 0/0/0.40 multipoint
 pvc 0/50
  encapsulation aal5mux ppp virtual-template 1
  !
 pvc 0/51
  encapsulation aal5mux ppp virtual-template 1
  !

Verifying and Troubleshooting PPPoA

Step 1 Enter the show atm pvc ppp privileged EXEC command to display the PPPoA characteristics of all PVCs on the ATM interface:

Router# show atm pvc ppp

                 VCD /
ATM Int.         Name         VPI   VCI  Type   VCSt  VA   VASt IP Addr
0/0/0            1              0    33   PVC     UP   1   DOWN 10.123.1.1
0/0/0            foo            0    34   PVC     UP   2   DOWN 10.123.1.1

The "VA" column shows the virtual-access interface used for this particular PPPoA session.

Step 2 Enter the show interface virtual-access privileged EXEC command to display the PPP specific characteristics of the session:

Router# show interface virtual-access 2

Virtual-Access2 is up, line protocol is up
  Hardware is Virtual Access interface
  Internet address is 10.123.1.1/24
  MTU 1500 bytes, BW 100000 Kbit, DLY 100000 usec, rely 255/255, load 1/255
  Encapsulation PPP, loopback not set, keepalive not set
  DTR is pulsed for 5 seconds on reset
  LCP Open
  Open: IPCP

  Bound to ATM0/0/0 VCD: 2, VPI: 0, VCI: 34

    Cloned from virtual-template: 1

  Last input 01:04:26, output never, output hang never
  Last clearing of "show interface" counters 5d02h
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     782 packets input, 30414 bytes, 0 no buffer
     Received 3 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     395 packets output, 5540 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out
     0 carrier transitions

The lines highlighted in the previous example show the layer 3 protocols enabled on this interface, the VPI and VCI numbers, and the master virtual template from which this virtual access interface was cloned.

PPP Authentication

Large-scale deployment of PPP user services requires the use of a central database, such as TACACS+ or RADIUS to ease the configuration burden. RADIUS or TACACS+ servers, collectively known as authentication, authorization, and accounting (AAA) servers for PPP over ATM (and other media), contain the per-user configuration database, including password authentication and authorization information. For more information about AAA, see the "Authentication, Authorization, and Accounting (AAA)" chapter in the Cisco IOS Security Configuration Guide .

PPP authentication configuration consists of the following tasks:

Task 1: Selecting the PPP Authentication Method

To select the PPP authentication method, complete the following steps in global configuration mode:

	Command	Description
Step 1	`Router(config)# aaa new-model`	Enables the AAA access control model.
Step 2	`Router(config)# aaa authentication ppp {default \| list-name} method1 [method2...]`	Specifies one or more authentication methods for use on interfaces running PPP.

The list-name option refers to the name of this particular method list (or default, if it is the default list). The authentication method options are local, RADIUS, or TACACS+.

Example : Selecting the TACACS+ and RADIUS PPP Authentication Methods

In the following example, virtual template 3 is configured to use TACACS+ before RADIUS, and virtual template 4 is configured to use RADIUS before local authentication:

!
aaa new-model
aaa authentication ppp list1 tacacs+ radius
aaa authentication ppp list2 radius local
!
interface virtual-template 3
 ip unnumbered fastethernet 0/0/0
 ppp authentication chap list1
 !
interface virtual-template 4
 ip unnumbered fastethernet 0/0/0
 ppp authentication chap list2
 !

Example : Selecting the Local PPP Authentication Method

In the following example, only the local username database is used for authentication:

!
aaa new-model
aaa authentication ppp default local
!

Task 2 (Option 1): Configuring Communication with a RADIUS Server

Note This task is required if you configured the RADIUS authentication method.

To configure the NRP to communicate properly with a RADIUS server, complete the following steps in global configuration mode:

Command Purpose

	Command	Purpose
Step 1	`Router(config)# radius-server host {hostname \| ip-address} [auth-port port-number] [acct-port port-number]`	Specifies a RADIUS server host. You do not have to specify the authentication and accounting port numbers because they default to 1645 and 1646, respectively.
Step 2	`Router(config)# radius-server key key`	Sets the encryption key to match that used on the RADIUS server.
Step 3	`Router(config)# radius-server attribute nas-port format d`	Selects the ATM VC extended format (d) for the NAS port field.

Step 1

Router(config)# radius-server host 
{hostname | ip-address} 

[auth-port port-number] [acct-port port-number]

Specifies a RADIUS server host.

You do not have to specify the authentication and accounting port numbers because they default to 1645 and 1646, respectively.

Step 2

Router(config)# radius-server key key

Sets the encryption key to match that used on the RADIUS server.

Step 3

Router(config)# radius-server 
attribute nas-port format d

Selects the ATM VC extended format (d) for the NAS port field.

Example : Configuring Communication with a RADIUS Server

In the following example, a RADIUS server is enabled and identified, and the NAS port field is set to ATM VC extended format:

!
aaa new-model
aaa authentication ppp default radius
!
radius-server host 172.31.5.96 auth-port 1645 acct-port 1646
radius-server key foo
radius-server attribute nas-port format d
!

Task 2 (Option 2): Configuring Communication with a TACACS+ Server

Note This task is required if you configured the TACACS+ authentication method.

To configure the NRP to communicate properly with a TACACS+ server, complete the following steps in global configuration mode:

	Command	Purpose
Step 1	`Router(config)# tacacs-server host {hostname \| ip-address} [single-connection] [port integer] [timeout integer] [key string]`	Specifies a TACACS+ server host.
Step 2	`Router(config)# tacacs-server key key`	Sets the encryption key to match that used on the TACACS+ daemon.

Example : Configuring Communication with a TACACS+ Server

In the following example, a TACACS+ server is enabled and identified:

!
aaa new-model
aaa authentication ppp default tacacs+
!
tacacs-server host 172.31.5.96
tacacs-server key foo
!

PPPoA/PPPoE Autosense on ATM VC

Note Before performing these tasks, read the "Restrictions" section.

PPPoA/PPPoE autosense enables the network access server (NAS) to distinguish between incoming PPPoA and PPPoE sessions, and to allocate resources on demand for both PPP types. You can configure PPPoA/PPPoE autosense on a single PVC or on a VC class that can be applied to all PVCs on an ATM interface.

PPPoA/PPPoE autosense provides resource allocation on demand. For each PVC configured for both PPPoA and PPPoE, certain resources (including one virtual-access interface) are allocated upon configuration, regardless of the existence of a PPPoA or PPPoE session on that PVC. With PPPoA/PPPoE autosense, resources are allocated for PPPoA and PPPoE sessions only when a client initiates a session, reducing overhead on the network access server (NAS).

Note Whenever possible, configure PPPoA and PPPoE to use the same virtual template. Using separate virtual templates leads to the inefficient use of virtual access because the maximum number of virtual-access interfaces will have to be precloned twice: once for PPPoE and once for PPPoA. If PPPoA and PPPoE use the same virtual template, the maximum number of virtual-access interfaces can be precloned once and used for PPPoA and PPPoE as needed.

Option 1: Configuring PPPoA/PPPoE Autosense on a PVC

To configure PPPoA/PPPoE autosense on a PVC, complete the following steps beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)# interface atm 0/0/0[.subinterface-number] {multipoint \| point-to-point \| tag-switching}`	Specifies the ATM interface and optional subinterface.
Step 2	`Router(config-subif)# pvc [name] vpi/vci`	Configures a PVC on the ATM interface or subinterface.
Step 3	`Router(config-if-atm-vc)# encapsulation aal5autoppp Virtual-Template number`	Configures PPPoA/PPPoE autosense on the PVC. Also specifies the virtual template interface to clone the new virtual access interfaces for PPPoA sessions on this PVC.

Example : Configuring PPPoA/PPPoE Autosense on a PVC

In the following example, the NAS is configured with PPPoA/PPPoE autosense on PVC 30/33.

!
! Configure PPPoA/PPPoE autosense 
!
interface ATM 0/0/0.33 multipoint
  pvc 30/33 
     encapsulation aal5autoppp Virtual-Template1
!
! Configure PPPoE
!
vpdn enable
vpdn-group 1
  accept dialin pppoe virtual-template 1
!
ip cef
interface virtual-template 1
  ip unnumbered fastethernet 0/0/0
  mtu 1492
  ip route-cache cef
!
! Enable precloning for virtual-template 1
!
virtual-template 1 pre-clone 2000 
!

Option 2: Configuring PPPoA/PPPoE Autosense on a VC Class

Note Virtual access interfaces for PPPoE sessions are cloned from the virtual template interface specified in the VPDN group.

To configure PPPoA/PPPoE autosense on a VC class, complete the following steps beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)#vc-class atm vc-class-name`	Creates and names a map class.
Step 2	`Router(config-vc-class)#encapsulatio n aal5autoppp Virtual-Template number`	Configures PPPoA/PPPoE autosense on the VC class. Also specifies the virtual template interface to use to clone the new virtual access interfaces for PPPoA sessions on this PVC.
Step 3	`Router(config-vc-class)#exit`	Returns to global configuration mode.
Step 4	`Router(config)#interface atm 0/0/0[.subinterface-number] {multipoint \| point-to-point \| tag-switching}`	Specifies the ATM interface and optional subinterface.
Step 5	`Router(config-subif)#class-int vc-class-name`	Applies the VC class to all VCs on the ATM interface or subinterface.

Example : Configuring PPPoA/PPPoE Autosense on a VC Class

In the following example, the NAS is configured with PPPoA/PPPoE autosense on the VC class called "MyClass." MyClass applies the PPPoA/PPPoE autosense feature to all PVCs on the ATM 0/0/0.99 interface:

!
! Configure PPPoA/PPPoE autosense
!
vc-class ATM MyClass
  encapsulation aal5autoppp Virtual-Template1
!
interface ATM 0/0/0.99 multipoint
  class-int MyClass
  no ip directed-broadcast
  pvc 20/40
  pvc 30/33 
!
! Configure PPPoE
!
vpdn enable
vpdn-group 1
  accept dialin pppoe virtual-template 1
!
ip cef
interface virtual-template 1
  ip unnumbered fastethernet 0/0/0
  mtu 1492
  ip route-cache cef
!
! Enable precloning for virtual-template 1
!
virtual-template 1 pre-clone 2000
!

Example : Configuring PPPoA/PPPoE Autosense on Multiple VC Classes and Virtual Templates

In the following example, PPPoA and PPPoE sessions are handled separately by two VC classes and two virtual templates:

ip cef
vpdn enable
!
vpdn-group 1
 accept-dialin
  protocol pppoe
  virtual-template 1
pppoe limit per-mac 1
pppoe limit per-vc 1
!
virtual-template 1 pre-clone 1500
!
interface ATM0/0/0.1 multipoint
no ip directed-broadcast
class-int pppoe
!
interface ATM0/0/0.3 multipoint
no ip directed-broadcast
class-int pppoa
!
interface ATM0/0/0.9 multipoint
ip address 10.16.40.1 255.255.0.0
no ip directed-broadcast
!
interface Virtual-Template1
ip unnumbered ATM0/0/0.9
ip route-cache cef
no ip directed-broadcast
peer default ip address pool pool-1
ppp authentication pap
!
interface Virtual-Template2
ip unnumbered ATM0/0/0.9
ip route-cache cef
no ip directed-broadcast
peer default ip address pool pool-2
ppp authentication chap
!
vc-class atm pppoe
 encapsulation aal5autoppp Virtual-Template1
!
vc-class atm pppoa
 encapsulation aal5autoppp Virtual-Template2
!

Verifying PPP Autosense Configuration

To verify that you successfully configured PPPoA/PPPoE autosense, enter the show running-config EXEC command.

Monitoring and Maintaining PPPoA/PPPoE Autosense

Use the following commands to monitor and maintain PPPoA/PPPoE autosense:

Command Purpose

Command	Purpose
`Router# show atm pvc [ppp]`	After the client at the other end of the PVC has initiated a PPPoA session, use this command to check that the PVC contains the PPPoA session.
`Router# show caller`	Enter this command to: View individual users and consumed resources on the NAS. Inspect active call statistics for large pools of connections. (The debug commands produce too much output and tax the CPU too heavily.) Display the absolute and idle times for each user. The current values for both of these settings are displayed on the TTY line and the asynchronous interface. Users who have been idle for unacceptably long periods of time can be easily identified. By using this information, you can define timeout policies and multiple grades of services for different users.
`Router# show interface virtual access number`	Displays information about the virtual access interface, LCP, protocol states, and interface statistics. The status of the virtual access interface should read: `Virtual-Access3 is up, line protocol is up`

Router# show atm pvc 
[ppp]

After the client at the other end of the PVC has initiated a PPPoA session, use this command to check that the PVC contains the PPPoA session.

Router# show caller

Enter this command to:

View individual users and consumed resources on the NAS.
Inspect active call statistics for large pools of connections. (The debug commands produce too much output and tax the CPU too heavily.)
Display the absolute and idle times for each user. The current values for both of these settings are displayed on the TTY line and the asynchronous interface. Users who have been idle for unacceptably long periods of time can be easily identified. By using this information, you can define timeout policies and multiple grades of services for different users.

Router# show interface 
virtual access number

Displays information about the virtual access interface, LCP, protocol states, and interface statistics. The status of the virtual access interface should read:

Virtual-Access3 is up, line protocol is up

Troubleshooting PPPoA/PPPoE Autosense

To troubleshoot PPP sessions establishment, use the following commands:

debug ppp negotiation
debug ppp authentication

To troubleshoot the establishment of PPP sessions that are authenticated by a RADIUS or TACACS server, use the following commands:

debug aaa authentication
debug aaa authorization

Caution Use debug commands with extreme caution because they are CPU-intensive and can seriously impact your network.

PPPoE Session Count MIB

Note Before performing these tasks, read the Restrictions and Prerequisites sections.

The PPPoE Session-Count MIB provides the ability to use Simple Network Management Protocol (SNMP) to monitor in real time the number of PPPoE sessions configured on PVCs and on a router.

The PPPoE Session-Count MIB also introduces two SNMP traps that generate notification messages when a PPPoE session-count threshold is reached on any PVC or on the router. You can configure the PPPoE session-count thresholds by using the pppoe limit max-sessions and pppoe max-sessions commands.

Table 4-2 describes the objects and tables supported by the PPPoE Session-Count MIB. For a complete description of the MIB, see the PPPoE Sessions Management MIB file CISCO-PPPOE-MIB.my, available through Cisco.com at the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml .

Table 4-2: PPPoE Session Count MIB Objects and Tables

Object	Description
cPppoeSystemCurrSessions	Number of PPPoE sessions active on the router.
cPppoeSystemHighWaterSessions	Total number of PPPoE sessions configured on the router since the system was initialized.
cPppoeSystemMaxAllowedSessions	Number of PPPoE sessions configurable on the router.
cPppoeSystemThresholdSessions	Threshold value of PPPoE sessions configurable on the router.
cPppoeSystemExceededSessionErrors	Accumulated number of errors on the router that have occurred because the cPppoeSystemCurrSessions value exceeded the cPppoeSystemMaxAllowedSessions value.
cPppoeVcCfgTable	PPPoE protocol-related configuration information about the virtual channel links (VCLs).
cPppoeVcSessionsTable	Configuration information and statistics about the number of PPPoE sessions on the VCLs.
cPppoeSystemSessionThresholdTrap	Generates a notification message when the number of PPPoE sessions on the router reaches the configured threshold value.
cPppoeVcSessionThresholdTrap	Generates a notification message when the number of PPPoE sessions on the PVC reaches the configured threshold value.

The PPPoE Session Count MIB provides the following benefits:

Allows the monitoring of PPPoE session counts using SNMP.
Helps to manage the number of PPPoE sessions configured on a router or PVC by sending notification messages when the PPPoE session threshold has been reached.
Provides a way to track PPPoE session information over time.

See the following sections for configuration tasks for the PPPoE Session Limit MIB feature. Each task in the list is identified as optional or required.

Enabling PPPoE Session Count SNMP Traps (required)
Configuring the PPPoE Session-Count Threshold for the Router (optional)
Configuring the PPPoE Session-Count Threshold for a PVC (optional)
Configuring the PPPoE Session Count Threshold for a VC Class (optional)
Configuring the PPPoE Session-Count Threshold for an ATM PVC Range (optional)
Configuring the PPPoE Session-Count Threshold for an Individual PVC Within a Range (optional)
Verifying PPPoE Session Count Thresholds (optional)

Enabling PPPoE Session Count SNMP Traps

To enable SNMP traps that send notification messages when PPPoE session thresholds have been reached, use the following command in global configuration mode:

Command	Purpose
`Router(config)#snmp-server enable traps pppoe`	Enables PPPoE session-count Simple Network Management Protocol (SNMP) notifications.

Example : Enabling PPPoE Session-Count SNMP Traps

The following example enables the router to send PPPoE session-count SNMP notifications to the host at the address 10.64.131.20:

snmp-server community public RW
snmp-server enable traps pppoe
snmp-server host 10.64.131.20 version 2c public udp-port 1717

Configuring the PPPoE Session-Count Threshold for the Router

To configure the PPPoE session-count threshold for the router, use the following commands beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)#vpdn group name`	Associates a virtual private dialup network (VPDN) group with a customer or VPDN profile.
Step 2	`Router(config-vpdn)#accept dialin`	Creates an accept dial-in VPDN group.
Step 3	`Router(config-vpdn-acc-in)#pro tocol pppoe`	Configures the Layer 2 Tunneling Protocol (L2TP) that the VPDN subgroup will use.
Step 4	`Router(config-vpdn-acc-in)#virtual-template template-number`	Specifies the virtual template to clone virtual access interfaces.
Step 5	`Router(config-vpdn)#pppoe limit max-sessions number-of-sessions [threshold-sessions number-of-sessions]`	Sets the maximum number of PPPoE sessions that are permitted on a router, and sets the PPPoE session-count threshold at which an SNMP trap is generated.

Example : Configuring the PPPoE Session-Count Threshold for the Router

The following example shows a limit of 4000 PPPoE sessions configured for the router. The PPPoE session-count threshold is set at 3000 sessions, so when the number of PPPoE sessions on the router reaches 3000, an SNMP trap is generated.

vpdn enable
no vpdn logging
!
vpdn-group 1
 accept-dialin
  protocol pppoe
  virtual-template 1
 pppoe limit max-sessions 4000 threshold-sessions 3000

Configuring the PPPoE Session-Count Threshold for a PVC

To configure the PPPoE session-count threshold for a PVC, use the following commands beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)#interface atm number [point-to-point \| multipoint]`	Configures an ATM interface.¹
Step 2	`Router(config-if)#pvc [name] vpi/vci`	Configures the PVC.
Step 3	`Router(config-if-atm-vc)#pppoe max-session number-of-sessions [threshold-sessions number-of-sessions]`	Sets the maximum number of PPPoE sessions that will be permitted on an ATM PVC, PVC range, virtual circuit (VC) class, or VLAN, and sets the PPPoE session-count threshold at which an SNMP trap will be generated.

¹To determine the correct form of the interface atm command, consult your ATM network module, port adapter, or router documentation.

Example : Configuring the PPPoE Session-Count Threshold for a PVC

The following example shows a limit of 5 PPPoE sessions configured for the PVC. The PPPoE session-count threshold is set at 3 sessions, so when the number of PPPoE sessions on the PVC reaches 3, an SNMP trap is generated.

interface ATM0/0/0
 ip address 10.0.0.1 255.255.255.0
 no atm ilmi-keepalive
 pvc 5/120
  protocol ip 10.0.0.2 broadcast
  pppoe max-sessions 5 threshold-sessions 3

protocol pppoe

Configuring the PPPoE Session Count Threshold for a VC Class

To configure the PPPoE session-count threshold for a VC class, use the following commands beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)#vc-class atm name`	Creates a VC class for an ATM PVC, SVC, or ATM interface.
Step 2	`Router(config-vc-class)#pppoe max-session number-of-sessions [threshold-sessions number-of-sessions]`	Sets the maximum number of PPPoE sessions that are permitted on an ATM PVC, PVC range, VC class, or VLAN, and sets the PPPoE session-count threshold at which an SNMP trap is generated.

Example : Configuring the PPPoE Session Count Threshold for a VC Class

The following example shows a limit of 7 PPPoE sessions configured for a VC class called "main". The PPPoE session-count threshold is set at 3 sessions, so when the number of PPPoE sessions for the VC class reaches 3, an SNMP trap is generated.

vc-class atm main

pppoe max-sessions 7 threshold-sessions 3

Configuring the PPPoE Session-Count Threshold for an ATM PVC Range

To configure the PPPoE session- count threshold for an ATM PVC range, use the following commands beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)#interface atm number [point-to-point \| multipoint]`	Configures an ATM interface.¹
Step 2	`Router(config-if)#range [range-name] pvc start-vpi/start-vci end-vpi/end-vci`	Defines a range of ATM PVCs.
Step 3	`Router(cfg-if-atm-range)#pppoe max-session number-of-sessions [threshold-sessions number-of-sessions]`	Sets the maximum number of PPPoE sessions that are permitted on an ATM PVC, PVC range, VC class, or VLAN, and sets the PPPoE session-count threshold at which an SNMP trap is generated.

¹To determine the correct form of the interface atm command, consult your ATM network module, port adapter, or router documentation.

Example : Configuring the PPPoE Session-Count Threshold for an ATM PVC Range

The following example shows a limit of 20 PPPoE sessions configured for the PVC range. The PPPoE session-count threshold is also be 20 sessions because when the session-count threshold has not been explicitly configured, it defaults to the PPPoE session limit. An SNMP trap is generated when the number of PPPoE sessions for the range reaches 20.

interface ATM0/0/0.3 point-to-point
 range pvc 3/100 3/105
  pppoe max-sessions 20

protocol pppoe

Configuring the PPPoE Session-Count Threshold for an Individual PVC Within a Range

To configure the PPPoE session-count threshold for an individual PVC within an ATM PVC range, use the following commands beginning in global configuration mode:

	Command	Purpose
Step 1	`Router(config)#interface atm number [point-to-point \| multipoint]`	Configures an ATM interface.¹
Step 2	`Router(config-if)#range [range-name] pvc start-vpi/start-vci end-vpi/end-vci`	Defines a range of ATM PVCs.
Step 3	`Router(cfg-if-atm-range)#pvc-i n-range [pvc-name] [vpi/vci]`	Configures an individual PVC within a PVC range.
Step 4	`Router(cfg-if-atm-range-pvc)#pppoe max-session number-of-sessions [threshold-sessions number-of-sessions]`	Sets the maximum number of PPPoE sessions that are permitted on an ATM PVC, PVC range, VC class, or VLAN, and sets the PPPoE session-count threshold at which an SNMP trap is generated.

¹To determine the correct form of the interface atm command, consult your ATM network module, port adapter, or router documentation.

Example : Configuring the PPPoE Session-Count Threshold for an Individual PVC Within a Range

The following example shows a limit of 10 PPPoE sessions configured for "pvc1". The PPPoE session-count threshold is set at 3 sessions, so when the number of PPPoE sessions for the PVC reaches 3, an SNMP trap is generated.

interface atm 6/0.110 multipoint
 range range1 pvc 100 4/199
  pvc-in-range pvc1 3/104
   pppoe max-sessions 10 threshold-sessions 3

Verifying PPPoE Session Count Thresholds

To verify the configuration of PPPoE session-count thresholds, use the following command in EXEC mode:

Command	Purpose
`Router#more system:running-config`	Displays the running configuration.

Monitoring and Maintaining PPPoE Session Counts and SNMP Notifications

To monitor PPPoE session counts and SNMP notifications, use the following commands in EXEC mode:

Command	Purpose
`Router#debug snmp packets`	Displays information about every SNMP packet sent or received by the router.
`Router#debug vpdn pppoe-errors`	Displays PPPoE protocol errors that prevent a session from being established or errors that cause an established session to be closed.
`Router#debug vpdn pppoe-packets`	Displays each PPPoE protocol packet exchanged.
`Router#show vpdn [session][packets][tunnel][all]`	Displays information about active tunnel and message identifiers in a VPDN.

Table of Contents

Point-to-Point Protocol

Restrictions

PPPoE

PPPoA

PPPoA/PPPoE Autosense on ATM VC

PPPoE Session Count MIB

Prerequisites

PPP Scalability

PPPoE Session Count MIB

Basic PPPoE Configuration

Task 1: Configuring a Virtual Template for PPPoE

Task 2: Configuring PPPoE on the ATM Interface

Task 3: Setting the MTU

Verifying PPPoE

Examples: Configuring PPPoE

Example: PPPoE Configuration on a PVC

Example: PPPoE Configuration Using a VC Class

Example: Concurrent PPPoE and Bridging

Monitoring and Maintaining PPPoE

Basic PPPoA Configuration

Task 1: Configuring a Virtual Template for PPPoA

Examples: Configuring a Virtual Template for PPPoA

Task 2: Configuring PPPoA on a PVC

Task 3: Configuring Authentication

Example: Basic PPPoA Configuration

Verifying and Troubleshooting PPPoA

PPP Authentication

Task 1: Selecting the PPP Authentication Method

Example: Selecting the TACACS+ and RADIUS PPP Authentication Methods

Example: Selecting the Local PPP Authentication Method

Task 2 (Option 1): Configuring Communication with a RADIUS Server

Example: Configuring Communication with a RADIUS Server

Task 2 (Option 2): Configuring Communication with a TACACS+ Server

Example: Configuring Communication with a TACACS+ Server

PPPoA/PPPoE Autosense on ATM VC

Option 1: Configuring PPPoA/PPPoE Autosense on a PVC

Example: Configuring PPPoA/PPPoE Autosense on a PVC

Option 2: Configuring PPPoA/PPPoE Autosense on a VC Class

Example: Configuring PPPoA/PPPoE Autosense on a VC Class

Example: Configuring PPPoA/PPPoE Autosense on Multiple VC Classes and Virtual Templates

Verifying PPP Autosense Configuration

Monitoring and Maintaining PPPoA/PPPoE Autosense

Troubleshooting PPPoA/PPPoE Autosense

PPPoE Session Count MIB

Enabling PPPoE Session Count SNMP Traps

Example: Enabling PPPoE Session-Count SNMP Traps

Configuring the PPPoE Session-Count Threshold for the Router

Example: Configuring the PPPoE Session-Count Threshold for the Router

Configuring the PPPoE Session-Count Threshold for a PVC

Example: Configuring the PPPoE Session-Count Threshold for a PVC

Configuring the PPPoE Session Count Threshold for a VC Class

Example: Configuring the PPPoE Session Count Threshold for a VC Class

Configuring the PPPoE Session-Count Threshold for an ATM PVC Range

Example: Configuring the PPPoE Session-Count Threshold for an ATM PVC Range

Configuring the PPPoE Session-Count Threshold for an Individual PVC Within a Range

Example: Configuring the PPPoE Session-Count Threshold for an Individual PVC Within a Range

Verifying PPPoE Session Count Thresholds

Monitoring and Maintaining PPPoE Session Counts and SNMP Notifications

Examples : Configuring PPPoE

Examples : Configuring a Virtual Template for PPPoA

Example : Selecting the TACACS+ and RADIUS PPP Authentication Methods

Example : Selecting the Local PPP Authentication Method

Example : Configuring Communication with a RADIUS Server

Example : Configuring Communication with a TACACS+ Server

Example : Configuring PPPoA/PPPoE Autosense on a PVC

Example : Configuring PPPoA/PPPoE Autosense on a VC Class

Example : Configuring PPPoA/PPPoE Autosense on Multiple VC Classes and Virtual Templates

Example : Enabling PPPoE Session-Count SNMP Traps

Example : Configuring the PPPoE Session-Count Threshold for the Router

Example : Configuring the PPPoE Session-Count Threshold for a PVC

Example : Configuring the PPPoE Session Count Threshold for a VC Class

Example : Configuring the PPPoE Session-Count Threshold for an ATM PVC Range

Example : Configuring the PPPoE Session-Count Threshold for an Individual PVC Within a Range