This chapter contains tasks for setting up the participants on either end of the PPPoE tunnel: the PPPoE client and PPPoE access server. Specific topics include the following:Major Tasks for Setting Up a PPPoE Tunnel (Task Maps) Setting Up the PPPoE Client Setting Up a PPPoE Access Server The tasks use the scenario that was introduced in Planning for DSL Support Over a PPPoE Tunnel as an example. For an overview of PPPoE, refer to Support for DSL Users Through PPPoE. The following tables list the major tasks for configuring PPPoE clients and the PPPoE access server. To implement PPPoE at your site, you need to set up only your end of the PPPoE tunnel, either the client side or access-server side.Task Description For Instructions 1. Configure an interface for PPPoE Define the Ethernet interface to be used for the PPPoE tunnel. How to Configure an Interface for a PPPoE Client 2. Configure information about the PPPoE access server Define parameters for the access server at the service provider end of the PPPoE tunnel. How to Define a PPPoE Access Server Peer 3. Set up the PPP configuration files Define the PPP configuration files for the client, if you have not done so already. How to Define Communications Over the Serial Line 4. Create the tunnel Call the access server. How to Define a PPPoE Access Server Peer Task Description For Instructions 1. Set up a PPPoE access server Define the Ethernet interface to be used for the PPPoE tunnel and define the services that the access server offers. How to Set Up a PPPoE Access Server 2. Set up the PPP configuration files Define the PPP configuration files for the client, if you have not done so already. Configuring Communications Over the Dial-in Server 3. (Optional) Restrict use of an interface Use PPPoE options and PAP authentication to restrict use of a particular Ethernet interface to certain clients. How to Restrict the Use of an Interface to Particular Clients To provide PPP to client systems over DSL, you must first configure PPPoE on the interface that is connected to the modem or hub. Then you need to change the PPP configuration files to define the access server on the opposite end of the PPPoE.Before you set up the PPPoE client, you must have done the following:Installed Solaris 8 Update 6 release or subsequent releases on the client machines to use the PPPoE tunnel. Contacted the service provider for information about its PPPoE access server. Had the telephone company or service provider assemble the devices that are used by the client machines. These devices include, for example, the DSL modem and the splitter, which the telephone company rather than you might assemble. Use this procedure to define the Ethernet interface to be used for the PPPoE tunnel. Become superuser on the PPPoE client or assume an equivalent role.Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services. To configure a role with the Primary Administrator profile, see Chapter 2, Working With the Solaris Management Console (Tasks), in System Administration Guide: Basic Administration. Add the name of the Ethernet interface with the DSL connection to the /etc/ppp/pppoe.if file.For example, you add the following entry to /etc/ppp/pppoe.if for a PPPoE client that uses hme0 as the network interface that is connected to the DSL modem. hme0For more information about /etc/ppp/pppoe.if, go to /etc/ppp/pppoe.if File. Configure the interface for PPPoE use.# /etc/init.d/pppd start Verify that the interface is now plumbed for PPPoE.# /usr/sbin/sppptun query hme0:pppoe hme0:pppoedYou can also use the /usr/sbin/sppptun command to manually plumb interfaces for PPPoE. For instructions, refer to /usr/sbin/sppptun Command. You define the access server in the /etc/ppp/peers/peer-name file. Many of the options that are used for the access server are also used to define the dial-in server in a dial-up scenario. For a detailed explanation of /etc/ppp/peers.peer-name, refer to /etc/ppp/peers/peer-name File. Become superuser on the PPPoE client or assume an equivalent role.Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services. To configure a role with the Primary Administrator profile, see Chapter 2, Working With the Solaris Management Console (Tasks), in System Administration Guide: Basic Administration. Define the service provider's PPPoE access server in the /etc/ppp/peers/peer-name file.For example, the following file, /etc/ppp/peers/dslserve, defines the access server dslserve at Far ISP that is introduced in Example of a Configuration for a PPPoE Tunnel. # cat /etc/ppp/peers/dslserve sppptun plugin pppoe.so connect "/usr/lib/inet/pppoec hme0" noccp noauth user Red password redsecret noipdefault defaultrouteFor a definition of the options in this file, go to /etc/ppp/peers/peer-name File for Defining an Access Server Peer. Modify the other PPP configuration files on the PPPoE client.Configure /etc/ppp/options as described in the instructions for configuring a dial-out machine in Configuring the Dial-out Machine. Create an /etc/ppp/options.sppptun file. /etc/ppp/options.sppptun defines PPP options for the serial port to which the interface that is plumbed for PPPoE is attached.You can use any options that are available for the /etc/ppp/options.ttyname file that is described in /etc/ppp/options.ttyname Configuration File. You must name the file /etc/ppp/options.sppptun because sppptun is the specified device name in the pppd configuration. Ensure that all users can start PPP on the client.# touch /etc/ppp/options Test if PPP can run over the DSL line.% pppd debug updetach call dslservedslserve is the name that is given to the access server at the ISP that is shown in Example of a Configuration for a PPPoE Tunnel. The debug updetach option causes debugging information to be displayed in a terminal window.If PPP is running correctly, the terminal output shows the link becoming active. If PPP still does not run, try the following command to see if the servers are running correctly:# /usr/lib/inet/pppoec -i hme0Users of configured PPPoE clients can begin running PPP over a DSL line by typing the following:% pppd call ISP-server-nameThen the users can run an application or a service. The following list provides references to related information.See Setting Up the PPPoE Client. See Creating PPPoE Tunnels for DSL Support. See Chapter 21, Fixing Common PPP Problems (Tasks). See Setting Up a PPPoE Access Server. If your company is a service provider, you can offer Internet and other services to clients that reach your site through DSL connections. The procedure involves determining which interfaces on the server to involve in the PPPoE tunnel and defining which services are made available to the users.Use this procedure to define the Ethernet interface to be used for the PPPoE tunnel and to configure the services that the access server offers. Become superuser on the access server or assume an equivalent role.Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services. To configure a role with the Primary Administrator profile, see Chapter 2, Working With the Solaris Management Console (Tasks), in System Administration Guide: Basic Administration. Add the name of the Ethernet interfaces that are dedicated to the PPPoE tunnels to the /etc/ppp/pppoe.if file.For example, you would use the following /etc/ppp/pppoe.if file for the access server dslserve that is shown in Example of a Configuration for a PPPoE Tunnel.# cat /etc/ppp/pppoe.if hme1 hme2 Define global services that are provided by the access server in the /etc/ppp/pppoe file.The following /etc/ppp/pppoe file lists the services that are provided by access server dslserve, which was shown in Figure 16–5.device hme1,hme2 service internet pppd "proxyarp 192.168.1.1:" service debugging pppd "debug proxyarp 192.168.1.1:"In the file example, Internet service is announced for dslserve's Ethernet interfaces hme1 and hme2. Debugging is turned on for PPP links on the Ethernet interfaces. Set up the PPP configuration files in the same way that you would for a dial-in server.For more information, refer to Creating an IP Addressing Scheme for Callers. Start the pppoed daemon.# /etc/init.d/pppd startpppd also plumbs the interfaces that are listed in /etc/ppp/pppoe.if. Verify that the interfaces on the server are plumbed for PPPoE.# /usr/sbin/sppptun query hme1:pppoe hme1:pppoed hme2:pppoe hme2:pppoedThe previous sample shows that interfaces hme1 and hme2 are currently plumbed for PPPoE. You can also use the /usr/sbin/sppptun command to manually plumb interfaces for PPPoE. For instructions, refer to /usr/sbin/sppptun Command. Become superuser on the access server or assume an equivalent role.Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services. To configure a role with the Primary Administrator profile, see Chapter 2, Working With the Solaris Management Console (Tasks), in System Administration Guide: Basic Administration. Modify /etc/ppp/pppoe, as needed. Cause the pppoed daemon to recognize the new services.# pkill -HUP pppoed The next procedure shows how to restrict an interface to a group of PPPoE clients. Before performing this task, you need to obtain the real Ethernet MAC addresses of the clients you are assigning to the interface.Some systems allow you to change the MAC address on the Ethernet interface. You should view this ability as a convenience factor, not a security measure. Using the example that is shown in Example of a Configuration for a PPPoE Tunnel, these steps show how to reserve one of dslserve's interfaces, hme1, for clients at MiddleCo. Configure the access server's interfaces and define the services, as shown in How to Set Up a PPPoE Access Server. Create entries for clients in the server's /etc/ethers database.Here is a sample entry for clients Red, Blue, and Yellow.8:0:20:1:40:30 redether 8:0:20:1:40:10 yellowether 8:0:20:1:40:25 blueetherThe sample assigns the symbolic names redether, yellowether, and blueether to the Ethernet addresses of clients Red, Yellow, and Blue. The assignment of symbolic names to the MAC addresses is optional. Restrict services that are provided on a specific interface by defining the following information in the /etc/ppp/pppoe.device file.In this file, device is the name of the device to be defined.# cat /etc/ppp/pppoe.hme1 service internet pppd "name dslserve-hme1" clients redether,yellowether,blueetherdslserve-hme1 is the access server's name, which is used in matching entries in the pap-secrets file. The clients option restricts the use of interface hme1 to clients with the symbolic Ethernet names redether, yellowether, and blueether. If you did not define symbolic names for client's MAC addresses in /etc/ethers, you can use the numeric addresses as arguments for the clients option. Wildcards are allowed.For example, you can specify the numeric address clients 8:0:20:*:*:*. By using wildcards, all matching addresses in /etc/ethers are accepted. Create the /etc/ppp/pap-secrets file for the access server: Red dslserve-hme1 redpasswd * Blue dslserve-hme1 bluepasswd * Yellow dslserve-hme1 yellowpassd *The entries are the PAP names and passwords of clients that are allowed to run PPP over dslserve's hme1 interface. For more information about PAP authentication, see Configuring PAP Authentication. The following list provides references to related information.To learn more about PPPoE, see Creating PPPoE Tunnels for DSL Support. To troubleshoot PPPoE and PPP problems, see Solving PPP-Related and PPPoE-Related Problems. To configure a PPPoE client, see Setting Up the PPPoE Client. To configure PAP authentication for a client, see Configuring PAP Authentication for Trusted Callers (Dial-out Machines). To configure PAP authentication on a server, see Configuring PAP Authentication on the Dial-in Server.