Juniper JUNOSE 11.1.X - LINK LAYER CONFIGURATION 4-7-2010, Configuration Manual

Page: 303 / 774

■
Performance depends on the number of packets exchanged during the
negotiation. When the number of packets exchanged increases—that is, when
the number of round-trips increases—it takes longer to finish the interface
negotiation. System resources are locked for a longer duration. As a result it
takes longer to bring up all the interfaces.
The number of round-trip message exchanges varies with the EAP authentication
method. When no retransmission of packets takes place and there is no
fragmentation, PAP and CHAP require one round-trip, EAP-MD5-Challenge
requires two round-trips, and EAP-TLS requires four round-trips.
Retransmission increases the number of round-trips. When the negotiated EAP
authentication method requires fragmentation, such as for the exchange of large
certificate chains, then the number of round-trips increases.
■
The number of simultaneous EAP negotiations is limited to 50 because of resource
limitations. Consequently, the time required to bring up interfaces when you
configure EAP authentication is longer than when you specify PAP or CHAP
authentication.
■
EAP authentication methods fragment packets when the EAP packet size is
greater than the link MTU. The EAP server must fragment the EAP packet to the
size of the Framed-Mtu attribute contained in the RADIUS Access-Request packet.
If the server fragments the packet to a larger size than specified by the attribute,
then JUNOSe drops the packet, because the E Series router acts as a pass-through
device and is not involved in the authentication method's fragmentation and
reassembly mechanisms.
On the other hand, if the EAP server fragments the EAP packet to a smaller size
than specified by the attribute, then performance decreases because of the
increased number of smaller packets that must be exchanged.
■
The EAP client on the peer must fragment the EAP packets to the size of the link
MTU on the E Series router. When it does not do so, performance can be affected.
Remote Peer Scenarios During Negotiation of PPP Options
During a PPP configuration request, if any of the primary or secondary DNS option
is rejected, or if they are unacceptable, the CPE (Customer Premises Equipment) is
prompted to negotiate the IPCP primary and secondary DNS options that are locally
available with the B-RAS (Broadband Remote Access Server). This provision is
controlled by CLI and SNMP configuration options.
The following describes the peer negotiations in different scenarios:
■
The CPE does not send the prompted options in the subsequent configure request
■
If B-RAS sends another NAK, it prompts the options again, until max
configure-nak is exceeded
■
If B-RAS sends an ACK, it ignores the options and brings up the link
■
The CPE negotiates a different option from the prompted options
■
If B-RAS sends another NAK, it prompts the options again, until max
configure-nak is exceeded
Overview
■ 271
Chapter 8: Configuring Point-to-Point Protocol