PPPoE - How does it reach the Radius Server?

Question

Hi guys I have a couple of questions related to PPPoE.

When an ISP provides a service and they use a Radius Server for Authentication how does the client router know where to send the Authentication request?

For example I am of the understanding that when the router is turned on at some point it will send a PPPoE Active Discovery Initiation (PADI) packet, according to this page. http://whatismyipaddress.com/ppp-pppoe

How does the router know the address of the Radius server to send the packet to? Does the packet simply hop from gateway to gateway broadcasting the packet until it hits a Radius server?

Secondly whilst using an active internet connection, is it possible to say Authenticate through another PPPoE server outside of the current network so that you can receieve a different public IP? or is the only way to use another network, is to use a VPN.

Apologies if these questions are a bit moronic, I'm just trying to wrap my head around this.

Answer 1

For your home router to establish a WAN connection to your ISP, a few things specific to PPP must happen first. You may also have to do some research on LCP and NCP.

Check this link below, it may have the answer you are looking for (see the excerpt on PPPoE below): https://infoproducts.alcatel-lucent.com/html/0_add-h-f/93-0098-09-01/7750_SR_OS_Triple_Play_Guide/concepts_PPPoE.html

PPPoE has two phases, the discovery phase and the session phase.•
Discovery: The client identifies the available servers. To complete the phase the client and server must communicate a session-id. During the discovery phase all packets are delivered to the PPPoE control plane (CPM or MDA). The IOM identifies these packets by their ethertype (0x8863).

→ PPPoE Active Discovery Initiation (PADI). This broadcast packet is used by the client to search for an active server (Access Concentrator) providing access to a service.

→ PPPoE Active Discovery Offer (PADO): If the access server can provide the service it should respond with a unicast PADO to signal the client it may request connectivity. Multiple servers may respond and the client may choose a server to connect to.

→ PPPoE Active Discovery Request (PADR): After the client receives a PADO it will use this unicast packet to connect to a server and request service.

→ PPPoE Active Discovery Session-confirmation (PADS) A server may respond to the client with this unicast packet to establish the session and provide the session-id. Once the PADS was provided the PPP phase begins.

• Session: Once the session ID is established connectivity is available for the duration of the session, using ethertype 0x8864. Either client or server can terminate a session.

During the life of the session the packets may be uniquely identified by the client’s MAC address and session-id. The session can terminate either by PADT sent by the client or server or by an LCP Terminate-Request packet.

Answer 2

In short, your client does not interact directly with the RADIUS server, the head-end router does.

Your client speaks to the head-end router, which is configured to only allow authenticated connections, so it queries the client for authentication. Your client responds to the head-end router, which forwards an authentication to the RADIUS server, which says "Let him in" or "Not allowed". If the head-end router lets the client complete the connection, then some time later it restarts the authentication challenge, to make sure the client is still allowed and hasn't been swapped for an unauthorized client.

Answer 3

The router you dial into forwards the authentication request to a RADIUS server, the client itself does not contact the RADIUS server directly. The router's configuration will have a list of RADIUS servers to use. There are numerous of configuration samples to be found on the internet, it's pretty standard and widely deployed.

A quick google gave me this: http://www.cisco.com/c/en/us/support/docs/wan/point-to-point-protocol-ppp/10361-advancedradius.html. The same goes for PPPoE, the encapsulation is just different. Here we can see the following statements:

! Use RADIUS for PPP connections
aaa authentication ppp default if-needed radius
! Use server 10.1.1.3 for authentication and authorization
radius-server host 10.1.1.3 auth-port 1645 acct-port 0
! Use server 10.1.1.5 for accounting
radius-server host 10.1.1.5 auth-port 0 acct-port 1646

Multiple RADIUS servers can be defined to allow for redundancy. It would help if you provide us with the brand and type of router you have to provide a configuration sample.