Pppoe Ia - Tripp Lite NGI-M08C4POE8-2 Owner's Manual

6.13 PPPoE IA

PPPoE Intermediate Agent (PPPoE IA) is placed between a subscriber and BRAS to help the
service provider BRAS distinguish between end hosts connected over Ethernet to an access
switch. On the access switch, PPPoE IA enables Subscriber Line Identification by appropriately
tagging Ethernet frames of different users (The tag contains specific information like which
subscriber is connected to the switch and VLAN). PPPoE IA acts as mini security firewall
between host and BRAS by intercepting all PPPoE Active Discovery (PAD) messages on a per-
port per-vlan basis. It provides specific security feature such as verifying the intercepted PAD
message from untrusted port, inserting and removing VSA Tags (vendor-specific tag) into and
from PAD messages.
PPPoE Discovery Stage
1. The PPPoE client broadcasts a PADI packet that contains information about the service type
it requests.
2. PPPoE IA intercepts PPPoE discovery frames from the client and inserts a unique line
identifier (circuit-id/remote-id) using the PPPoE Vendor-Specific tag (0x0105) to PADI
(PPPoE Active Discovery Initiation) packets. The PPPoE IA forwards these packets to the
PPPoE server after the insertion.
3. After receiving a PADI packet that it can serve, a PPPoE server replies with a PADO packet.
The destination address of the PADO packet is the unicast packet of the host that sent the
PADI.
4. Depending on the network topology, since the PADI was broadcast, the PPPoE client may
receive PADO packets sent by multiple PPPoE servers. Among these PPPoE servers, the
PPPoE client selects the one whose PADO packet arrived the earliest and unicast's a PADR
packet to the PPPoE server.
5. Depending on the network topology, since the PADI was broadcast, the PPPoE client may
receive PADO packets sent by multiple PPPoE servers. Among these PPPoE servers, the
PPPoE client selects the one whose PADO packet arrived the earliest and unicasts a PADR
187