PPPoE 246
Point-to-Point Agreement over Ethernet (PPPoE), accurate in RFC 2516, is an
encapsulation of Point-to-Point Agreement (PPP, RFC 1661) for Ethernet networks
(which accommodate DSL modems and cable connections). PPPoE is generally acclimated in
SOHO environments because it allows ISPs to use their absolute alien access
infrastructure and, as its best important feature, allows accurate IP address
assignment. PPPoE links are accustomed in two capital phases:
Alive analysis appearance During this aboriginal phase, a PPPoE client
attempts analysis of the PPPoE server, additionally alleged the abode concentrator
(AC).The PPPoE band is accustomed and a affair ID is assigned.
PPP affair appearance A PPP articulation is accustomed (encapsulated in
Ethernet) by the accepted means: options and articulation band protocols are negotiated
etc. PPP affidavit (PAP, CHAP, or MS-CHAP) is performed.
After the affair is established, abstracts campaign amid endpoints encapsulated in
PPPoE headers.
The PIX firewall supports PPPoE back software adaptation 6.2. Best of the
PPPoE agreement is performed appliance the vpdn command. PPPoE configuration
starts with configuring the username and countersign to be acclimated by the PIX in
establishing a articulation to the server.
NOTE
The PIX alone supports PPPoE applicant functionality. PPPoE audience can be
enabled alone on the alfresco interface at this time (version 6.2).
First, a VPDN accumulation needs to be created:
vpdn accumulation
www.syngress.com
210 Affiliate 4 • Avant-garde PIX Configurations
The group_name constant can be annihilation you like. It is acclimated to accumulation all
PPPoE settings together. For example:
PIX1(config)# vpdn accumulation my-pppoe-group appeal dialout pppoe
Then the affidavit blazon needs to be called (if appropriate by an ISP):
vpdn accumulation
PAP is Countersign Affidavit Protocol, CHAP is Challenge-Handshake
Authentication Protocol, and MS-CHAP is Microsoft’s adaptation of CHAP.With
the aforementioned accumulation name, this command selects an affidavit agreement for this
specific PPPoE group—for example, with CHAP authentication:
PIX1(config)# vpdn accumulation my-pppoe-group ppp affidavit chap
Your ISP assigns the username and countersign to your system, and they are
configured on PIX with the afterward commands:
vpdn accumulation
vpdn username
The added of these commands assembly a username with the password, and
the aboriginal command assigns the username to be acclimated for a specific group, for
example:
PIX1(config)# vpdn accumulation my-ppoe-group localname witt
PIX1(config)# vpdn username witt countersign cruelmail
These commands accredit the username witt and countersign cruelmail to be used
for the PPPoE dialout accumulation my-pppoe-group. After configuring authentication, the
next assignment is to accredit the PPPoE applicant on the PIX.This is done in the configuration
of the alfresco interface:
ip abode alfresco pppoe [setroute]
After this command is entered, the accepted PPPoE affair is concluded and a
new one is established.The setroute constant allows automatically ambience the
default avenue for the alfresco interface.The MTU on the alfresco interface is automatically
set to 1492, which is the actual ambience to accommodate PPPoE encapsulation.
It is additionally accessible to baptize a anchored IP abode for the alfresco interface.
The PIX still has to accommodate the ISP with the actual username and countersign in
order to authorize the session:
PIX1(config)# ip abode alfresco 1.2.3.4 255.255.255.0 pppoe
www.syngress.com
Advanced PIX Configurations • Affiliate 4 211
It is accessible to use the dhcp auto_config command if you run the DHCP
server on PIX in adjustment to aces up DNS and WINS settings from your provider
via the PPPoE client:
PIX1(config)# dhcpd auto_config outside
To adviser and troubleshoot the PPPoE client, use the afterward commands:
show ip abode alfresco pppoe
debug pppoe accident | absurdity | packet
show vpdn affair pppoe [id
Examples of achievement are as follows:
PIX1(config)# appearance vpdn
Tunnel id 0, 1 alive sessions
time back change 10240 secs
Remote Internet Abode 10.0.1.1
Local Internet Abode 192.168.2.254
1006 packets sent, 1236 received, 98761 bytes sent, 123765 received
Remote Internet Abode is 10.0.1.1
Session accompaniment is SESSION_UP
Time back accident change 10237 secs, interface outside
PPP interface id is 1
1006 packets sent, 1236 received, 98761 bytes sent, 123765 received
PIX1(config)# appearance vpdn tunnel
PPPoE Tunnel Advice (Total tunnels=1 sessions=1)
Tunnel id 0, 1 alive sessions
time back change 10240 secs
Remote Internet Abode 10.0.1.1
Local Internet Abode 192.168.2.254
1006 packets sent, 1236 received, 98761 bytes sent, 123765 received
PIX1(config)# appearance vpdn session
PPPoE Affair Advice (Total tunnels=1 sessions=1)
Remote Internet Abode is 10.0.1.1
Session accompaniment is SESSION_UP
Time back accident change 100238 secs, interface outside
PPP interface id is 1
1006 packets sent, 1236 received, 98761 bytes sent, 123765 received
www.syngress.com
212 Affiliate 4 • Avant-garde PIX Configurations
Summary
The Cisco PIX firewall is an avant-garde artefact and has abounding altered options
for acknowledging assorted application-layer protocols as able-bodied as attention against
network-layer attacks. It additionally supports agreeable clarification for outbound Web access,
intrusion detection, assorted acquisition options such as RIP and butt multicast
routing, and DHCP server and applicant functionality.
Many protocols bury added IP abode advice central the exchanged
packets or accommodate added admission on nonfixed ports in adjustment to function
properly.These functions are handled by the PIX appliance analysis feature
(also accepted as fixup). PIX supports FTP audience and servers in alive and
passive modes, DNS, RSH, RPC, SQL*Net, and LDAP protocols. It additionally supports
various alive protocols such as Real-Time Alive Protocol, NetShow,
and VDO Live. Another set of accurate protocols includes all H.323, SCCP, and
SIP—all acclimated in VoIP applications.The PIX monitors casual packets for the
embedded advice and updates its tables or permits beginning connections
according to this information. It is additionally able to NAT these anchored addresses in
several cases.
Content clarification appearance on the PIX can be acclimated to accomplish a company’s
acceptable use policy.The PIX can interface with Websense (www.websense.com)
or N2H2 (www.n2h2.com) servers and abjure or acquiesce centralized audience admission specific
Web sites.The PIX is additionally able to clarify out Java applets and ActiveX code
from admission Web pages to assure audience adjoin awful code.
The PIX firewall supports the aforementioned set of diminutive advance apprehension signatures
as the Cisco IOS firewall.This set is a subset of signatures accurate by the
Cisco Secure IDS product.These signatures are disconnected into two sets: informational
and attack. It is accessible to configure altered acknowledgment options for anniversary set
of signatures.The responses ambit from simple alerting via syslog to blocking the
connection in which a signature was detected.
For SOHO environments, the PIX firewall provides DHCP server and client
functionality, although server capabilities are rather limited. DHCP server supports
a brace of specific options that are acclimated by Cisco IP Phones. Added useful
PIX appearance accommodate abutment of butt multicast acquisition and PPP over Ethernet
client capabilities. It additionally supports RIP versions 1 and 2, including authentication
and multicast updates for adaptation 2.
Finally, the PIX has anchored aegis adjoin assorted DoS attacks, such as
SYN floods, attacks on AAA mechanisms, and boundless fragmentation.
Antispoofing is accurate by the reverse-path forwarding feature.
www.syngress.com
Advanced PIX Configurations • Affiliate 4 213
Solutions Fast Track
Handling Avant-garde Protocols
Abounding applications use added than one affiliation to operate; alone one
of these admission occurs on a acclaimed port, admitting others use
dynamically assigned anchorage numbers, which are adjourned in the process
of communication.This makes firewalling by agency of admission lists very
difficult.The PIX supports appliance analysis for abounding such
protocols, which allows it to accomplish accurately with them.
The capital command acclimated to configure appliance analysis is the fixup
command. It can be acclimated for simpler protocols such as FTP, SMTP, or
RSH.
Newer versions of the PIX firewall action abutment for assorted VoIP
protocols, such as H.323, SCCP, and SIP.
Filtering Web Traffic
Clarification Web cartage can be advantageous in two capital cases.The aboriginal is if you
want to use your firewall to accomplish aegis behavior such as an
acceptable use policy, which may specify that centralized users cannot use
the company’s Internet affiliation to browse assertive categories of Web
sites.The added is to assure centralized users from awful Web servers
that bury these executable applets in their Web pages, because such
executable agreeable can accommodate bacilli or Trojan horses.
The PIX supports two types of agreeable clarification servers:Websense and
N2H2.The capital commands for configuring this affection are filter-url and
url-server.The PIX additionally provides abounding commands for ecology and
tuning the clarification process.
Alive cipher clarification is bound to stripping