Mutual Authentication; Route Installation; L2Tp Dial-Out Platform Considerations; L2Tp Dial-Out References - Juniper JUNOSE 11.1.X - BROADBAND ACCESS CONFIGURATION GUIDE 6-4-2010 Configuration Manual

JUNOSe 11.1.x Broadband Access Configuration Guide
After an outgoing call is successfully signaled, the router dynamically creates a PPP
interface. The profile in the dial-out route definition specifies any PPP configuration
options. Both the L2TP session and the PPP interface exist on a Service module,
identical to the LNS operation for incoming calls.
Once the PPP interface is created, Link Control Protocol (LCP) and IPCP are negotiated.

Mutual Authentication

Mutual authentication takes place in LCP, where the LNS validates the PPP interface
on the remote CPE and vice-versa. LNS takes the same actions to authenticate the
peer as it does on incoming calls.
The LNS obtains the PPP username and password from the initial Access-Accept
message. It then provides this information to the remote CPE for authentication.

Route Installation

Once authentication is complete, the router creates a new access route. This route
directs the forwarding of IP packets related to the original trigger packet to the newly
created interface. The route does not need to be identical to the one specified in the
dial-out route, but it must be able to forward packets that have the same destination
address as the trigger packet. However, if the access route does not encompass the
dial-out route definition, any other trigger packets initiate a new dial-out session.
The dial-out state machine verifies that the trigger packet can be forwarded over the
route.

L2TP Dial-Out Platform Considerations

L2TP dial-out is supported on all E Series routers.
For information about the modules supported on E Series routers:

L2TP Dial-Out References

For more information about L2TP, see RFC 2661 Layer Two Tunneling Protocol "
L2TP" (August 1999).
418
L2TP Dial-Out Platform Considerations
If the verification is unsuccessful, the dial-out session is put into the failed state.
If the verification is successful, the dial-out session is put into the inService state.
See the ERX Module Guide for modules supported on ERX7xx models, ERX14xx
models, and the ERX310 Broadband Services Router.
See the E120 and E320 Module Guide for modules supported on the E120 and
E320 Broadband Services Routers.