Labcourse “Routerlab” Customer Access

The big picture Phone Network Phone Exchange Point of Presence Core Network ATM Network PPP-AC DSLAM Core Routers Access Router DSL Router Customer Datacenter Datacenter Modem Splitter Home Network

Accessing the Net PPPoE Connection ATM Circuit IP Data Phone Exchange Point of Presence Core Network ATM Network PPP-AC DSLAM Core Routers Access Router DSL Connection DSL Router Customer Datacenter Datacenter Modem Big picture, real network… Animation: Setup ATM circuit between DSLAM and PPP-AC Setup DSL Link, modem synchronization Dial-up: Setup PPP Connection 3a) PPP-AC hands over authentication data to RADIUS Server during PPP Handshake 4) IP Data possible Splitter RADIUS Auth. Request Home Network

PPP – Point-to-Point Protocol Encapsulates other protocols (tunnel) Enables AAA (authentication, authorization, accounting) Supports auto-configuration We consider IP over PPPoE (PPP over Ethernet)

Phases of PPP No Link Yes Authentication Link Establishment Yes Phase Established successful? Need authentication? Link Establishment Phase Authentication Phase Yes Link Dead Yes No Phases of a PPP Connection, Start at Link-DEAD. Authentication is optional Authentication successful? Link Termination Phase Network-Layer Protocol Phase Yes No

PPPoE Frame Ethernet Frame Dst. Addr Src. Addr Type PPPoE Data 0x8863: PPPoE Discovery 0x8864: PPPoE Session Ethernet Frame Data Dst. Addr Src. Addr Type PPPoE 0x00: Data 0x07: PADO 0x09: PADI 0x19: PADR 0x65: PADS 0xa7: PADT Always 0x1 Always 0x1 Announced in PADS Frame, before: 0x0000 Version (4 Bit) Type (4 Bit) Code (1 Byte) Session-ID (2 Byte) Length (2 Byte) PPP Protocol (2 Byte) Layout of a PPPoE Frame: Animation: Contents of Fields appear Payload Length in Bytes 0x0021: IP 0x8021: IP Control Prot. (IPCP) 0xc021: Link Control Prot. (LCP) 0xc023: Password Auth. Prot. (PAP) 0xc223: Challenge Handshake Auth. Prot. (CHAP) Payload (variable)

PPPoE Session DSL-AC Client PPPoE Active Discovery (AD) Initiation: PADI Broadcast Packet, optional: Service-Name PPPoE AD Offer: PADO Service-Name, AC-Name If multiple PADO: Choose one PPPoE AD Request: PADR Service-Name, AC-Name PPPoE AD Session Confirmation: PADS Session-ID PPP Session PPP Session handshake (LCP), including authentication IP configuration (IPCP) IP Session (Payload) Set local IP configuration Authenticate user and authorize session PPPoE AD Termination Can be sent by either side Record accounting data

RADIUS “Remote Authentication Dial-In User Service” Central RADIUS Server Provides authentication service for Network Access Servers (NAS) NAS: Every device that a user can use to connect to a network, e.g: PPP-AC, WPA access-point, 802.1x switch

PPP Session with RADIUS Client PPP-AC/NAS Auth. Server LCP: Conf Request Auth. Proto: PAP LCP: Conf Ack Auth. Proto: PAP RADIUS: Access Request Username + Password PAP: Auth Request Username + Password RADIUS: Access Accept Attributes: IP Address …. PAP: Auth Ack Username + Password IPCP: Conf Req. IP: 0.0.0.0 RADIUS: Accounting Start Attributes: IP Address Session ID …. Sample PPP Session. Note the IPCP Conf Reject: Server rejects IP “0.0.0.0” and proposes the real one. IPCP: Conf Reject IP: 1.2.3.4 Write accounting record RADIUS: Accounting Stop Attributes: Session ID Duration,Traffic Volume … LCP: Terminate Link Write accounting record

Excurse: Other providers Point of Presence Datacenter Core Network PPP-AC Access Router Phone Exchange Point of Presence Core Network ATM Network First: Reseller: Setup own RADIUS server, use complete infrastructure otherwise Own Core: Route some traffic though own core Own Core2: Route all traffic through own core, get IP directly from PoP Own PoP: Build own PoP. Switch ATM Circuit from DSLAM to own PPP-AC Colocate DSLAM: Setup own DSLAM in Phone Exchange, rewire phoneline to that DSLAM Not shown: own Phoneline PPP-AC DSLAM Core Routers Access Router DSL Router Customer Datacenter Datacenter Modem Splitter Home Network

The smaller picture Phone Network Point of Presence loadgen10X Phone Exchange Point of Presence Core Network ATM Network PPP-AC DSLAM Core Routers Access Router DSL Router Customer Datacenter Datacenter Modem Going from the big picture to the real routerlab configuration No phones, no phone network No DSLAM, No Modem, No ATM network, direct connection from DSL Router to PPP-AC Data-Center simplified: Just one loadgen acting as webserver No CoreNetwork: this has been done before. 5 RADIUS server installed on the same machine as the PPP-AC Splitter Home Network

The smaller picture Point of Presence loadgen10X rj1 PPP-AC Access Router DSL Router Customer Datacenter Loadgen103 VLAN 102 Home Network