I've got a weird one for you guys.

Take a look at the CMO diagram: enter image description here

The ISP requires all internet traffic be tagged over VLAN 35 via PPPoE.

I've run into an issue where if Device001 connects to PPPoE, it prevents Device002 from connecting to PPPoE and vice versa. I don't have control over the devices connecting over PPPoE so I have to take care of this at layer 2.

Take a look at my proposed FMO diagram: enter image description here

Is it possible to get VLANXX and VLANYY packets sent to VLAN35, but somehow prevent VLANXX and VLANYY from talking to each other?

Please note that the devices are not able to do any tagging, so all traffic to/from the devices is untagged.

Apologies if this is not making sense to anyone...


In this particular scenario:

DEV01 - Router

DEV02 - Windows Machine

If I establish DEV02 first, then DEV01... both work.

If I establish DEV01 first, DEV02 can't connect.

I figure DEV01 prevents further connections after it establishes it's PPPoE session.

1 Answer 1


PPPoE requires a continuous network segment, so the PPPoE server/endpoint and both clients all need to be in the same VLAN.

PPPoE connections are (usually) limited to one session at a time. So, while there's a valid session, a 2nd login will either be rejected or kill the 1st session. The problem is not that dev1 and dev2 can see each other (at least not likely, you're very scarce on details).

If you need both "devices" to simultaneously access the uplink, you'll need to not establish the session themselves but delegate that to a router which in turn lets both devices share its session. Usually - with a single public IP address - this will be a NAT router. With multiple public IPs you don't need NAT.

Another option would be to obtain a 2nd PPPoE account from your ISP to log into in parallel.

Why don't you just put the Windows machine behind the router?

  • See main question. Jun 24, 2017 at 22:41
  • Please add details to your question, so a new reader can make the most sense out of it.
    – Zac67
    Jun 24, 2017 at 22:44
  • Yes, I most definitely can put the windows machine behind the router. For academic purposes though, I wanted to see if I could isolate the two devices on separate VLANs to prevent them from talking to each other. If no one else weighs by the end of the day, I'll mark your answer as correct for stating that they need to be all on the same VLAN for PPPoE to occur. Jun 24, 2017 at 23:11
  • If you put one or both PPPoE clients into separate VLANs you disrupt the required L2 connection. You'll need to - somehow - forward the PPPoE packets into the fiber VLAN. This is possible but not too reasonable. Another possibility is to deploy a MAC filter in between the PPPoE clients to stop them seeing each other. This is (most probably) not even the problem, I'm sure the PPPoE sessions themselves are - to make sure you'd need to tap into the connections and analyze the PPPoE traffic as to why the 2nd session fails.
    – Zac67
    Jun 25, 2017 at 8:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.