D-Link DFL-210 - NetDefend - Security Appliance, User Manual

Page: 88 / 469

Microsoft CHAP (version 1 and 2). If authentication is used, at least one of the peers has to
authenticate itself before the network layer protocol parameters can be negotiated using NCP.
During the LCP and NCP negotiation, optional parameters such as encryption, can be negotiated.
3.3.4.2. PPPoE Client Configuration
The PPPoE interface
Since the PPPoE protocol runs PPP over Ethernet, the firewall needs to use one of the normal
Ethernet interfaces to run PPPoE over. Each PPPoE Tunnel is interpreted as a logical interface by
the NetDefendOS, with the same routing and configuration capabilities as regular interfaces, with
the IP rule set being applied to all traffic. Network traffic arriving at the firewall through the PPPoE
tunnel will have the PPPoE tunnel interface as its source interface. For outbound traffic, the PPPoE
tunnel interface will be the destination interface.
As with any interface, one or more routes are defined so NetDefendOS knows what IP addresses it
should accept traffic from and which to send traffic to through the PPPoE tunnel. The PPPoE client
can be configured to use a service name to distinguish between different servers on the same
Ethernet network.
IP address information
PPPoE uses automatic IP address allocation which is similar to DHCP. When NetDefendOS
receives this IP address information from the ISP, it stores it in a network object and uses it as the IP
address of the interface.
User authentication
If user authentication is required by the ISP, the username and password can be setup in
NetDefendOS for automatic sending to the PPPoE server.
Dial-on-demand
If dial-on-demand is enabled, the PPPoE connection will only be up when there is traffic on the
PPPoE interface. It is possible to configure how the firewall should sense activity on the interface,
either on outgoing traffic, incoming traffic or both. Also configurable is the time to wait with no
activity before the tunnel is disconnected.
Unnumbered PPPoE
When NetDefendOS acts as a PPPoE client, support for unnumbered PPPoE is provided by default.
The additional option also exists to force unnumbered PPPoE to be used in PPPoE sessions.
Unnumbered PPPoE is typically used when ISPs want to allocate one or more preassigned IP
addresses to users. These IP addresses are then manually entered into client computers. The ISP
does not assign an IP address to the PPPoE client at the time it connects.
A further option with the unnumbered PPPoE feature in NetDefendOS is to allow the specification
of a single IP address which is used as the address of the PPPoE client interface. This address can
serve the following purposes:
• The IP address specified will be sent to the PPPoE server as the "preferred IP". If unnumbered
PPPoE is not forced, the server may choose to not accept the preferred IP and instead assign
another IP address to the PPPoE client.
When the option to force unnumbered PPPoE is selected, the client (that is to say NetDefendOS)
will not accept assignment of another IP address by the server.
3.3.4. PPPoE Chapter 3. Fundamentals
88