PPP Network Control Protocol Negotiation
PPP Network Control Protocol Negotiation Mode Overview
The Network Control Protocol (NCP) is a mechanism used to establish and configure different Network Layer protocols for Point-to-Point Protocol (PPP) connections. Starting in Junos OS Release 14.1, on MX Series routers with Modular Port Concentrators (MPCs), you can configure PPP NCP negotiation to actively or passively control subscriber connections initiated by the router functioning as a PPP server.
Junos OS supports the following NCPs as presented in the associated IETF standards:
Internet Protocol Control Protocol (IPCP) in RFC 1332, The PPP Internet Protocol Control Protocol (IPCP)
IPv6 Control Protocol (IPv6CP) in RFC 5072, IP Version 6 over PPP
- PPP NCP Negotiation Modes
- PPP NCP Negotiation Mode Supported Configurations
- PPP NCP Active Negotiation Requirements for IPv4 Dynamic and Static PPP Subscribers
- PPP NCP Active Negotiation Requirements for IPv6 Dynamic and Static PPP Subscribers
- PPP NCP Negotiation Requirements for IPv4 and IPv6 Dual-Stack Configurations
PPP NCP Negotiation Modes
PPP NCP negotiation operates in either of the following modes:
Active PPP NCP negotiation mode—The router sends an NCP Configuration Request message without waiting for the PPP client to do so.
Passive PPP NCP negotiation mode—The router waits for the PPP client to send an NCP Configuration Request message before sending its own Configuration Request message. Dynamic subscriber interface connections and static subscriber interface connections use passive PPP NCP negotiation by default.
Router behavior for active mode and passive mode PPP NCP negotiation differs for dynamic PPP subscribers and static PPP subscribers, as summarized in Table 1.
PPP Subscribers |
PPP NCP Negotiation Mode |
Router Behavior |
---|---|---|
Dynamic |
Active |
The router establishes the local network address and uses it to send the NCP Configuration Request message without waiting for the PPP client to send a Configuration Request. |
Dynamic |
Passive |
The router establishes the local network address after it receives the NCP Configuration Request message from the PPP client. |
Static |
Active |
The router sends the authentication acknowledgement to the PPP client, and then sends the NCP Configuration Request message without waiting for the PPP client to send its own Configuration Request. |
Static |
Passive |
The router sends the authentication acknowledgement to the PPP client, and then waits for an NCP Configuration Request message from the client before sending a Configuration Request. |
PPP NCP Negotiation Mode Supported Configurations
You can configure PPP Network Control Protocol (NCP) negotiation for the following single-stack and dual-stack subscriber configurations on MX Series routers with MPCs:
Dynamic PPP subscriber connections terminated at the router
Static PPP subscriber connections terminated at the router
Dynamic tunneled PPP subscribers at the L2TP network server (LNS)
Static tunneled PPP subscribers at the L2TP network server (LNS) on an inline service (
si
) interface
PPP NCP Active Negotiation Requirements for IPv4 Dynamic and Static PPP Subscribers
To configure active PPP IPv4 Network Control Protocol (IPNCP) negotiation for dynamic and static PPP subscribers in a single-stack or dual-stack configuration, make sure you meet the following requirements:
Configure the IPv4 (
inet
) protocol family in a dynamic profile (for dynamic subscribers) or at the interface level (for static subscribers).Assign any of the following IPv4 address attributes for the subscriber during the authentication process:
Framed-IP-Address (RADIUS Attribute 8)—RADIUS explicit IPv4 address
Framed-Pool (RADIUS Attribute 88)—RADIUS IPv4 adress pool name
IPv4 attributes allocated from a locally configured address pool
When you have met these requirements, use the initiate-ncp
ip
statement to enable active IPNCP negotiation for dynamic
and static subscribers in a single-stack or dual-stack configuration.
PPP NCP Active Negotiation Requirements for IPv6 Dynamic and Static PPP Subscribers
To configure active PPP IPv6 Network Control Protocol (IPv6NCP) negotiation for dynamic and static PPP subscribers in a single-stack or dual-stack configuration, make sure you meet the following requirements:
Configure the IPv6 (
inet6
) protocol family in a dynamic profile (for dynamic subscribers) or at the interface level (for static subscriber).Assign any of the following IPv6 address attributes for the subscriber during the authentication process:
Delegated-IPv6-Prefix (RADIUS Attribute 123)—RADIUS explicit IPv6 address
Framed-IPv6-Prefix (RADIUS Attribute 97)—RADIUS explicit IPv6 prefix
Framed-IPv6-Pool (RADIUS Attribute 100)—RADIUS explicit IPv6 adress or prefix pool name
IPv6 attributes allocated from a locally configured Neighbor Discovery Router Advertisement (NDRA) pool
When you have met these requirements, use the initiate-ncp
ipv6
statement to enable active IPv6NCP negotiation for dynamic
and static subscribers in a single-stack or dual-stack configuration.
PPP NCP Negotiation Requirements for IPv4 and IPv6 Dual-Stack Configurations
You can configure either active or passive PPP NCP negotiation for the IPv4 and IPv6 subscriber interfaces in a dual-stack configuration.
To configure active negotiation in a dual-stack configuration, do all of the following:
Make sure you meet the IPv4 and IPv6 protocol and address family requirements.
Use the
initiate-ncp ip
statement to enable active negotiation for the IPv4 subscriber interface.Use the
initiate-ncp ipv6
statement to enable active negotiation for the IPv6 subscriber interface.
To configure passive negotiation in a dual-stack configuration, do both of the following:
Make sure you meet the IPv4 and IPv6 protocol and address family requirements.
Use the
initiate-ncp dual-stack-passive
statement to enable passive negotiation for the dual-stack configuration. Theinitiate-ncp dual-stack-passive
statement overrides theinitiate-ncp ip
andinitiate-ncp ipv6
statements if they are configured.
The following additional guidelines apply when you configure PPP NCP negotiation for dual-stack subscribers:
Dual-stack subscribers configured for either active mode or passive mode PPP NCP negotiation continue to use the same negotiation mode when the NCP mechanism is renegotiated.
Using the
on-demand-ip-address
statement to save IPv4 addresses for dual-stack PPP subscribers when you are not using the IPv4 service has no effect on configuration of the PPP NCP negotiation mode in a dual-stack configuration.
Controlling the Negotiation Order of PPP Authentication Protocols
You can control the order in which the router tries to negotiate PPP authentication protocols when it verifies that a PPP client can access the network. By default, the router first tries to negotiate Challenge Handshake Authentication Protocol (CHAP) authentication. If the the attempt to negotiate CHAP authentication is unsuccessful, the router then tries to negotiate Password Authentication Protocol (PAP) authentication.
You can modify this default negotiation order in any of the following ways:
Specify that the router negotiate PAP authentication first, followed by CHAP authentication if PAP negotiation is unsuccessful.
When you specify both authentication protocols in either order, you must enclose the set of protocol names in square brackets ([ ]).
Specify that the router negotiate only CHAP authentication.
Specify that the router negotiate only PAP authentication.
Before you begin:
Configure the CHAP or PAP protocol on the interface.
For dynamic PPP subscriber interfaces, see Configuring Dynamic Authentication for PPP Subscribers.
For CHAP on static interfaces with PPP encapsulation, see Configuring the PPP Challenge Handshake Authentication Protocol.
For PAP on static interfaces with PPP encapsulation, see Configuring the PPP Password Authentication Protocol On a Physical Interface.
For information about dynamic profiles for PPP subscribers, see Dynamic Profiles for PPP Subscriber Interfaces Overview.
To control the order in which the router negotiates PPP authentication protocols:
The following sample authentication
statements
in a dynamic profile named pppoe-client-profile show the different
ways you can configure the negotiation order for PPP authentication
protocols. (The authentication
statements for configuring
static interfaces are identical.)
To specify that the router negotiate PAP authentication first, followed by CHAP authentication:
[edit dynamic-profiles pppoe-client-profile interfaces pp0 unit “$junos-interface-unit” ppp-options] user@host# set authentication [pap chap]
To specify that the router negotiate only CHAP authentication:
[edit dynamic-profiles pppoe-client-profile interfaces pp0 unit “$junos-interface-unit” ppp-options] user@host# set authentication chap
To specify that the router negotiate only PAP authentication:
[edit dynamic-profiles pppoe-client-profile interfaces pp0 unit “$junos-interface-unit” ppp-options] user@host# set authentication pap
To restore the default negotiation order for PPP authentication protocols after you have modified it:
[edit dynamic-profiles pppoe-client-profile interfaces pp0 unit “$junos-interface-unit” ppp-options] user@host# set authentication [chap pap]
Configuring the PPP Network Control Protocol Negotiation Mode
Starting in Junos OS Release 14.1, configuring PPP Network Control Protocol (NCP) negotiation enables you to actively or passively control subscriber connections initiated by the router functioning as a PPP server. Both dynamic and static subscriber interface connections use passive PPP NCP negotiation by default.
You can configure the PPP NCP negotiation mode (active or passive) for the following subscriber configurations on MX Series routers with MPCs:
Dynamic PPP subscriber connections terminated at the router, using a dynamic profile
Static PPP subscriber connections terminated at the router, using a per-interface configuration
Dynamic tunneled PPP subscribers at the L2TP network server (LNS), using a dynamic profile
Static tunneled PPP subscribers at the LNS, using a per-inline service (
si
) interface configurationDynamic and static tunneled PPP subscribers at the LNS, using a user-group profile
To configure PPP NCP negotiation mode:
Ensuring IPCP Negotiation for Primary and Secondary DNS Addresses
Starting in Junos OS Release 15.1, you can configure a router to prompt any customer premises equipment (CPE) to send the IPv4 primary or secondary DNS address options in the next configuration request if the options are not included in an initial IPCP configuration request during IPCP negotiations or if the router rejects the request. This DNS option enables the router to control IPv4 DNS address provisioning for dynamic and static, terminated PPPoE and LNS subscribers. The router includes the address options in the IPCP configuration NAK message that it sends to the CPE. The CPE then negotiates both primary and secondary IPv4 DNS addresses. Using this option ensures that the CPE can use the DNS addresses available at the router.
To configure the router to prompt the CPE to negotiate the DNS addresses for dynamic PPPoE subscribers:
Specify the DNS negotiation option.
[edit dynamic-profiles profile-name interfaces pp0 unit “ $junos-interface-unit” ppp-options] user@host# set ipcp-suggest-dns-option
To configure the router to prompt the CPE to negotiate the DNS addresses for static PPPoE subscribers:
Specify the DNS negotiation option.
[edit interfaces interface-name ppp-options] user@host# set ipcp-suggest-dns-option
To configure the router to prompt the CPE to negotiate the DNS addresses for dynamic LNS subscribers:
Specify the DNS negotiation option.
[edit dynamic-profiles profile-name interfaces "$junos-interface-ifd-name" unit “ $junos-interface-unit” ppp-options] user@host# set ipcp-suggest-dns-option
To configure the router to prompt the CPE to negotiate the DNS addresses for static LNS subscribers:
Specify the DNS negotiation option.
[edit interfaces si-slot/pic/port unit logical-unit-number ppp-options] user@host# set ipcp-suggest-dns-option
To configure the router to prompt the CPE to negotiate the DNS addresses for tunneled PPP subscribers with an LNS user group profile:
Specify the DNS negotiation option.
[edit access group-profile profile-name ppp-options] user@host# set ipcp-suggest-dns-option
Change History Table
Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.