🚀 go-pugleaf

Ooh...ooh...I get to beat James to one.  :)

Thus spake John D Loop
>But how do you run DHCP except in an environment where the DHCP
>discovers can propogate?  i.e. an environment where broadcasts can
>propogate.  Does the Redback intercept these the same as the ARPs
>[question for me]?

Yeah, its called DHCP relay...works like a champ.

>Maybe what you are saying is the Redback implementation solves most of
>the problems of bridging.  It still seems like a customer can steal IPs
>and wreak havoc if he can alter the IP assigned under the mask.

Nope, they can't...it really and truly does work with RedBack.  I'm
doing it.

>Would the redback protect against this, i.e.  does it verify the
>customer is using his assigned IP?  

It doesn't verify explicitely that I'm aware of, but it knows (either
from RADIUS, DHCP, static config, and probably other options that I'm
not thinking of off the top of my head) what IP addresses are on what
"circuits" (RedBack terminology for a PVC or other type of "session")
and will only send arps for that IP address down that "circuit" so only
that customer can respond to the arp request.

>I wouldn't think so, especially if he didn't assign it [another
>question for me].  

It can learn the assignment by participating in the DHCP relay, or by a
RADIUS request when the PVC comes up, static config, etc.

>But you are still stuck with authentication via MAC, right.

Nope, I can see what MAC someone has on their ethernet card in the arp
cache, but I never look at that because I have no need to.  It learns
the IP <-> circuit mapping via RADIUS, DHCP, static config, etc.

>So it then gets down to the ISP who wants to do things like it is used
>to doing, like username/password and Radius servers, and this means ppp
>to them.

Nope, please don't make the mistake of assuming that RADIUS and PPP are
in any way inherently linked.  They are commonly used together, but
there is no reason that this is required.  RedBack AOS can create RADIUS
requests based on a PVC switching from down to up.  This can be used
with a RADIUS server to auto-configure PVCs for customers.

>Redback solved this problem for the ISPs as well by doing the ppp over
>the E! oh well...

I agree with James...PPPoE sucks and I won't touch it with a 39 1/2 foot
pole.  I think he's done a rather competent job of explaining why.
-- 
Jeff McAdams                            Email: jeffm@iglou.com
Head Network Administrator              Voice: (502) 966-3848
IgLou Internet Services                        (800) 436-4456