What is PPPoE?

Point-to-Point Protocol over Ethernet (PPPoE) is a protocol that encapsulates PPP frames inside Ethernet frames, most commonly used to connect a router or modem to an internet service provider over DSL. The WAN interface authenticates to the provider with a username and password before the connection is established.

Key takeaways

• PPPoE wraps PPP frames inside Ethernet frames for DSL and broadband links.
• The client authenticates to an access concentrator with a username and password.
• PPPoE supports LLC and VC-MUX multiplexing over Ethernet or xDSL interfaces.
• VOS devices configure PPPoE as a logical WAN subinterface tied to a VNI.
• Titan Portal enables PPPoE for Internet-only, SD-WAN-only, or split-tunnel traffic.

On this page: Why it matters · How it works · Types · PPPoE & Versa · FAQ

Why is PPPoE important?

PPPoE bridges PPP’s per-user authentication model and Ethernet’s shared, broadcast-domain design. DSL and broadband providers need a way to authenticate individual subscribers on a common access network – assign an IP address, enforce session limits, and generate accounting records – without wiring a dedicated PPP link to every customer. PPPoE gives providers one Ethernet access network on which each subscriber’s session is still individually authenticated, the same way a dial-up PPP session was.

That heritage is why PPPoE remains common in branch networking today. Many DSL, fiber, and cable circuits sold to small and mid-sized sites still terminate as PPPoE at the premises, so an SD-WAN edge device needs native PPPoE support just to accept those circuits as WAN transports at all.

What is PPPoE?

PPPoE has two stages. In the Discovery stage, the client broadcasts on the Ethernet segment to find an access concentrator (AC) – the provider’s aggregation device – which confirms the connection and returns a session ID. In the PPP Session stage, the Link Control Protocol (LCP) negotiates link options, an authentication protocol such as PAP or CHAP verifies the configured username and password, and the Network Control Protocol assigns network-layer parameters such as the client’s IP address.

Once a session is up, PPP frames ride inside a PPPoE header over Ethernet, which lowers the usable MTU (commonly to 1492 bytes) versus native Ethernet because of that added overhead. Periodic LCP echo requests keep the session alive; if the peer stops replying after a configured number of failures, the session is declared dead and torn down.

Types of PPPoE

PPPoE deployments vary along three axes documented for Versa WAN interfaces. Interface type is either Ethernet, the common case for fiber and cable modems, or xDSL, used when the appliance connects directly to a copper DSL line through an xDSL NIC module. Multiplexing type is LLC, which carries a protocol identifier in each frame and is the more common choice, or VC-MUX, which dedicates a virtual circuit to a single protocol instead. Instance type governs how traffic is routed: Internet Only sends everything to direct internet access (DIA), SD-WAN Only sends it into the SD-WAN VPN, and Split Tunnel sends VPN-bound traffic to the VPN and the rest to DIA on the same circuit.

PPPoE & Versa

VOS devices configure PPPoE as a logical WAN subinterface bound to a dedicated VNI interface, set up as a profile element or embedded in a Master Profile – see Configure PPPoE Interfaces in Concerto. Configuration includes the access concentrator name, service name, username and password, and the LCP echo interval and failure count that govern how quickly a dead peer is detected.

Titan Portal exposes the same PPPoE settings for CPE appliances, including CSG355 and CSG365 devices with xDSL NIC modules, and lets an operator choose interface type, multiplexing type, and traffic instance type – see Configure WAN Connections. A PPPoE username and password can be edited after deployment, but the instance itself cannot be removed or re-added afterward. Because GZTP activation is not supported over PPPoE, older appliances typically need a temporary DHCP or LTE circuit to activate before WAN1 becomes the permanent PPPoE circuit – see Titan Portal 9.1.1.

Frequently asked questions

What is the difference between PPPoE and PPP?

PPP is the base data-link protocol that establishes a direct connection between two nodes, originally over serial or dial-up links. PPPoE encapsulates PPP frames inside Ethernet frames so that same authentication and session model can run over a shared Ethernet network instead.

Why do DSL providers use PPPoE instead of plain PPP?

DSL access networks are shared Ethernet segments serving many subscribers through one aggregation device. PPPoE lets each subscriber’s modem or router open its own authenticated PPP session over that shared link, so the provider can assign addresses and bill individually without a dedicated line per customer.

What is an access concentrator?

An access concentrator (AC) is the provider-side device that answers PPPoE Discovery broadcasts, confirms the session, and issues a session ID to the client. Its name configured on the client must match the name configured on the server, or the session fails to establish.

Can PPPoE be used for SD-WAN transport?

Yes. VOS and Titan-managed appliances configure a PPPoE interface as a WAN subinterface, then assign its traffic to Internet-only, SD-WAN-only, or split-tunnel handling, letting a PPPoE-terminated broadband or DSL circuit serve as an active leg or backup path in an SD-WAN fabric.

Why does PPPoE reduce the usable MTU?

PPPoE adds its own header on top of the PPP header, and both ride inside an Ethernet frame with a fixed maximum size. That overhead leaves less room for payload, which is why PPPoE links commonly cap the MTU at 1492 bytes instead of Ethernet’s standard 1500.

More on PPPoE

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about PPPoE, these are worth looking at next.