Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

SRX Getting Started - PPPoE Configuration Examples

0

0

Article ID: KB15736 KB Last Updated: 26 Feb 2020Version: 6.0
Summary:

This article provides Point-to-Point over Ethernet (PPPoE) configuration examples.

For other topics, go to the SRX Getting Started main page.

Symptoms:

Configure PPPoE.

Solution:

This section contains the following:

 

Basic PPPoE Configuration Example

The following example illustrates a basic PPPoE configuration.
interfaces {
    fe-0/0/5 {
        unit 0 {
            encapsulation ppp-over-ether;
        }
    }
    pp0 {
        unit 0 {
            ppp-options {
                pap {
                    access-profile ppp-profile;
                    local-password "ABC123";##SECRET-DATA
                    local-name "username";
                    passive;
                }
            }
            pppoe-options {
                underlying-interface fe-0/0/5.0;
                auto-reconnect 10;
                client;
                idle-timeout 0;
            }
            family inet {
                negotiate-address;
                mtu 1492;
            }
        }
    }
}     
 

Complete PPPoE and ADSL Configuration Example

The following example is a complete working configuration example using the following settings:
  • ADSL is the primary WAN interface in the untrust zone.
  • A 3G is the backup interface, monitoring the primary ADSL (at) interface.
  • A dialup interface (external modem) is used as a failover.
  • The at-1/0/0 and pp0.0 interfaces are in the untrust zone.
  • For pp0.0, point-to-point is configured.
  • PAP is configured using the passive option.
  • The PPPoE underlying-interface and client options are configured.
  • All Ethernet ports are in a single VLAN group with a DHCP server providing service.
  • A default route to the DSL interface is configured.
  • Source NAT is enabled.
system {
    host-name SRX210;
    name-server {
        10.10.222.222;
        10.10.220.220;
    }
    services {
        ssh;
	telnet;
        web-management {
            http {
                interface vlan.0;
            }
            https {
                system-generated-certificate;
                interface vlan.0;
            }
        }
        dhcp {
	    domain-name example.com;
            router {
                192.168.0.1;
            }
            pool 192.168.0.0/24 {
                address-range low 192.168.0.100 high 192.168.0.199;

            }
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
}
interfaces {
    interface-range interfaces-trust {
	member ge-0/0/0;
        member ge-0/0/1;
        member fe-0/0/2;
        member fe-0/0/3;
        member fe-0/0/4;
        member fe-0/0/5;
        member fe-0/0/6;
        member fe-0/0/7;
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    cl-0/0/8 {
        traceoptions {
            flag all;
        }
        modem-options {
            init-command-string "AT&C1";
        }
        dialer-options {
            pool 1 priority 23;
        }
    }
    dl0 {
        unit 0 {
            family inet {
                negotiate-address;
            }
            dialer-options {
                pool 1;
                dial-string 1234;
            }
        }
    }
    at-1/0/0 {
        encapsulation ethernet-over-atm;
        atm-options {
            vpi 0;
        }
        dsl-options {
            operating-mode auto;
        }
        unit 0 {
            encapsulation ppp-over-ether-over-atm-llc;
            vci 0.35;
            backup-options {
                interface dl0.0;
            }
        }
    }
    pp0 {
        traceoptions {
            flag all;
        }
        unit 0 {
            point-to-point;
            ppp-options {
                pap {
                    default-password "$ABC123"; ## SECRET-DATA
                    local-name "user@host1.example.com";
                    local-password "$ABC123"; ## SECRET-DATA
                    passive;
                }
            }
            pppoe-options {
                underlying-interface at-1/0/0.0;
                client;
            }
            no-keepalives;
            family inet {
                negotiate-address;
            }
        }
    }
    vlan {
        unit 0 {
            family inet {
                address 192.168.0.1/24;
            }
        }
    }
}
routing-options {
    static {
	route 0.0.0.0/0 next-hop pp0.0 metric 0;
        route 0.0.0.0/0 next-hop dl0.0;
    }
}
security {
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
    }
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                vlan.0;
            }
        }
        security-zone untrust {
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    all;
                }
            }
            interfaces {
		at-1/0/0.0;
                pp0.0;
		dl0.0;
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}
poe {
    interface all;
}
vlans {
    vlan-trust {
        vlan-id 3;
        l3-interface vlan.0;
    }
}
 

Another configuration example is KB15347 - What will be the configuration for PPPoE over ATM on an ADSL interface?.

 

Technical Documentation

Interface Encapsulation Feature Guide for Security Devices

 

Troubleshooting

Use the show interfaces interface_name extensive command to review state and history information for the at and pp interfaces. For example:


user@host> show interfaces at-1/0/0 extensive
user@host>
show interfaces pp0 extensive

ADSL interface modules have LEDs that show sync and traffic status. For more information, see http://www.juniper.net/techpubs/en_US/release-independent/junos/topics/reference/specifications/mini-pim-adsl2-srx-series-leds.html.
 
Modification History:
2020-02-26: minor non-technical edits.
Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search