Configuring Encapsulation Type Lockout for PPPoE Clients

Configuring and Verifying Lockout for PPPoE Clients

To configure and verify encapsulation type lockout for a PPPoE client:

1. Configure the underlying physical interface.

   For example, the following commands configure a static ATM 1483 subinterface and corresponding ATM PVC. For more information about the atm pvc command, see Creating a PVC on an ATM 1483 Subinterface

   host1(config)#interface atm 3/0 host1(config-if)#interface atm 3/0.101 host1(config-subif)#atm pvc 10 10 20 aal5snap
2. Create a static PPPoE major interface.
   host1(config-subif)#encapsulation pppoe
3. Configure the PPPoE major interface to detect and accept dynamic PPPoE subinterfaces. Use the lockout-time keyword to configure a nondefault lockout time range for the PPPoE clients associated with the dynamic PPPoE subinterface column.

   For example, the following command configures a lockout time in the range 5–60 seconds for the PPPoE clients associated with the dynamic PPPoE subinterface column on the PPPoE major interface.

   host1(config-subif)#pppoe auto-configure lockout-time 5 60
4. Assign a profile to the PPPoE major interface.
   host1(config-subif)#pppoe profile pppoeLockoutProfile

   The default encapsulation type, any, applies to any autoconfigured encapsulation that does not have a specific profile assignment.

   For information about creating and using profiles, see Dynamic Interface Configuration Using a Profile and Configuring Profile Characteristics .

5. (Optional) Verify the lockout configuration by using either of the following commands.
   • To display summary information about the lockout configuration, use the show pppoe interface command. (The following example shows only the portion of the command display relevant to the PPPoE lockout configuration.)

     host1#show pppoe interface atm 3/0.101
     PPPoE interface ATM 3/0.101 is operStatusUp (dynamic)
     . . .

     Lockout Configuration (seconds): Min 5, Max 60
      Total clients in active lockouts: 0
      Total clients in lockout grace period: 0

   • To display detailed information about the current lockout condition for each PPPoE client associated with a specific source MAC address, use the show pppoe interface lockout-time command.

     This command displays multiple entries for the same MAC address if multiple IWF sessions contain the same MAC address. In the following example, more than one entry for the same PPPoE client MAC address, 0090.1a42.527c, is displayed under the Client Address column head. This method of display occurs because the MAC address in the Client Address field denotes the MAC address of the DSLAM device at which multiplexing functions are performed and not the address of the originating PPPoE client (access loop) for PPPoE sessions that contain the IWF-Session DSL Forum VSA (26-154).

     host1#show pppoe interface atm 12/1/1.1.1 lockout-time
     PPPoE interface atm 12/1/1.1
     Lockout Configuration (seconds): Min 90, Max 120
      Total clients in active lockout: 1
      Total clients in lockout grace period: 0
     Client Address Current Elapsed Next
     -------------- ------- ------- ----
     0090.1a42.527c     120      30  120
     0090.1a42.527c       0       0   90

     For a description of the fields in the command display, see Monitoring Summary Information about the Encapsulation Type Lockout for PPPoE Clients and Monitoring Detailed Information about the Current Encapsulation Type Lockout Condition for PPPoE Clients.

Clearing the Lockout Condition for a PPPoE Client

You can use the pppoe clear lockout interface command to clear the lockout condition for an individual PPPoE client associated with a dynamic PPPoE subinterface column on a static PPPoE major interface. To identify the PPPoE client, you must specify its source MAC address.

For information about the working of the dynamic encapsulation type lockout feature for PPPoE sessions that contain the IWF-Session DSL Forum VSA (26-254) in PADR packets, see Encapsulation Type Lockout Based on DSL Forum VSAs for IWF PPPoE Sessions.

Note: Issuing the pppoe clear lockout interface command resets the current lockout condition for the specified PPPoE client, but does not disable dynamic encapsulation type lockout for that PPPoE client.

To clear the current lockout condition for a PPPoE client:

1. Display the source MAC address assigned to the PPPoE client by issuing one of the following show commands:
   • To display the source MAC address when there is no available PPPoE session in progress, use the show pppoe interface lockout-time command.

     This command displays multiple entries for the same MAC address if multiple IWF sessions contain the same MAC address. In the following example, more than one entry for the same PPPoE client MAC address, 0090.1a42.527c, is displayed under the Client Address column head. This method of display occurs because the MAC address in the Client Address field denotes the MAC address of the DSLAM device at which multiplexing functions are performed and not the address of the originating PPPoE client (access loop) for PPPoE sessions that contain the IWF-Session DSL Forum VSA (26-154).

     host1#show pppoe interface atm 12/1/1.1.1 lockout-time
     PPPoE interface atm 12/1/1.1
     Lockout Configuration (seconds): Min 90, Max 120
      Total clients in active lockout: 1
      Total clients in lockout grace period: 0
     Client Address Current Elapsed Next
     -------------- ------- ------- ----
     0090.1a42.527c     120      30  120
     0090.1a42.527c       0       0   90

   • To display the source MAC address when a subscriber is connected to the router through an available PPPoE session, use either the show pppoe interface lockout-time command or the show pppoe subinterface full command. (The following example shows only the portion of the command display relevant to the source MAC address.)

     host1#show pppoe subinterface full
     ...
         PPPoE subinterface ATM 3/0.101 has source MAC address 0090.1a10.165e
     ...
     

   For a description of the fields in the command display, see Monitoring Detailed Information about the Current Encapsulation Type Lockout Condition for PPPoE Clients and Monitoring the Source MAC Address of a PPPoE Client.

2. Clear the current lockout condition for the PPPoE client associated with the specified source MAC address on the static PPPoE major interface.
   host1#pppoe clear lockout interface atm 3/0.101 0090.1a10.165e

   If the specified PPPoE client is undergoing active lockout or is in a lockout grace period, issuing the pppoe clear lockout interface command causes the router to reset the current lockout condition and start the next lockout interval at the minimum configured lockout time.

   The lockout grace period occurs when the time between lockout events is greater than either 15 minutes or the maximum lockout time. When a PPPoE client is in a lockout grace period, the router resets the number of consecutive lockout events to 1. (For more information, see Guidelines for Configuring Encapsulation Type Lockout for PPPoE Sessions.)