PPPoE
PPPoE access with full discovery, LCP, IPCP and IPv6CP. Configuration lives in the ppp view; the access-interface set is a list that applies live on commit.
Configuration
MRU for PPPoE maxes at 1492. auth-protocol takes a comma-separated set of allowed methods — the BNG proposes the strongest listed method and downgrades on NAK to any other listed method, refusing the rest.
system-view ppp interface add access0 access1 ppp mru 1492 ppp auth-protocol chap,pap ppp lcp-echo interval 30 failure 3 ppp setup-timeout 60 ppp ipv6 enable ppp ipv6 pool default commit save
Address fallback precedence
ppp pool selects which pool a session draws its framed IPv4 address from when RADIUS supplies no Framed-IP-Address and no Framed-Pool. Precedence is RADIUS Framed-Pool, then ppp pool, then the pool named default. The same RADIUS-first rule applies to IPv6 NA and PD prefixes.
MS-CHAP and encryption
MS-CHAP and MS-CHAPv2 authenticate via RADIUS — the NAS relays the challenge and response and never sees the password. Because the BNG does not negotiate MPPE, clients using MS-CHAP must be configured for optional rather than required encryption; a client that requires MPPE will bring the session up, find no encryption, and drop into a re-dial loop. PAP is unaffected.
Upstream spread and PPPoE RSS
Plain RSS cannot see inside PPPoE, so without inner-IP steering every upstream PPPoE packet lands on one queue and therefore one worker. show interface reports whether the inner-IP rte_flow rule is installed — but rule installed is not a promise of spreading: some adapters accept the rule without steering on it, because the silicon cannot parse past the PPPoE header. Confirm the real spread with show health under load, and enable the software dispatcher when the adapter cannot do it.
show interface access0 # RSS Supported / RSS Active / PPPoE RSS dispatch enable # software fan-out from worker 0 show health # per-worker busy cycle