Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

About Configuring PPPoE


Use the PPPoE option to configure how the device handles Point-to-Point Protocol over Ethernet (PPPoE) connections. PPPoE enables multiple users at a site to share the same digital subscriber line, cable modem, or wireless connection to the Internet. Some security devices support PPPoE, which enables them to operate compatibly on DSL, Ethernet Direct, and cable networks run by ISPs that use PPPoE for their clients’ Internet access.


Some ISPs use DHCP for their clients’ Internet access. To configure DHCP on an interface, see Example: Assigning TCP/IP Settings for Hosts Using DHCP (NSM Procedure). For more detailed explanation about PPPoE or DHCP on security devices, see the “Fundamentals” volume in the Concepts & Examples ScreenOS Reference Guide.

On devices that support PPPoE, you can configure a PPPoE client instance on any or all interfaces. You configure a specific instance of PPPoE with a username and password and other parameters, and bind the instance to an interface. When two Ethernet interfaces (a primary and a backup) are bound to the Untrust zone, you can configure one or both interfaces for PPPoE. Specifically:

  • For all security devices running ScreenOS 5.0 and later, you can enable PPPoE on multiple interfaces in any zone at the same time.

  • For all security devices running ScreenOS 5.1 and later, you can bind a PPPoE instance to a:

    • VSI interface—Use this option when running two devices using NSRP in active-passive mode. When failover occurs, the new primary device can use the same IP as the previous primary device to continue communicating with the ISP. Because the PPPoE connection is maintained, downtime during failover is minimized. To bind PPPoE instance to a VSI interface, you must have already created the NSRP cluster and the VSI interfaces.

    • Subinterface—Use this option to enable multiple PPPoE sessions on one physical interface. To bind the PPPoE instance to a subinterface, you must have already created the subinterface. For details, see Example: Configuring a Subinterface (NSM Procedure).


      The number of PPPoE sessions per physical interface is determined by the security device platform.