| 11.4 |  | PPPoE and the PIX Security Appliance |
| 11.4.2 |  | The PIX Security Appliance and PPPoE |

| Beginning with software version 6.2, the PIX Security Appliance can be configured as a PPPoE client. This makes it compatible with broadband offerings that require PPPoE usage and enables the PIX to secure broadband Internet connections. After it is configured, the PIX PPPoE client automatically connects to a service provider AC without user intervention. The maximum transmission unit (MTU) size is automatically set to 1492 bytes. This is the correct value to allow PPPoE to be transmitted in an Ethernet frame. All traffic flowing to, from, and through the interface is then encapsulated with PPPoE/PPP headers. The PIX Security Appliance also detects session termination and automatically attempts to reconnect.

The PIX Security Appliance PPPoE client can operate in environments where other PIX Security Appliance features are being used . For example, the following features function as usual:

- Network Address Translation (NAT) on traffic to or from the outside interface, or over a Virtual Private Network (VPN)
- URL and content filtering before transmission to or from the outside interface
- Application of firewall rules on traffic before transmission to or from the outside interface, or over a VPN

If an ISP PPPoE server distributes configuration parameters such as Domain Name System (DNS) and Windows Internet Naming Service (WINS) addresses along with the IP addresses it assigns to its clients, the PIX Security Appliance PPPoE client can retrieve these parameters and automatically pass them along to its DHCP clients. The PIX Security Appliance must be configured with the dhcpd auto_config option for this to work. Although the PIX Security Appliance Dynamic Host Configuration Protocol (DHCP) server feature functions normally with the PPPoE client enabled, its DHCP and PPPoE client features are mutually exclusive. When the administrator configures the DHCP client on the outside interface, the PPPoE client is automatically disabled. The converse of this configuration statement is also true. When the PPPoE client is configured, the DHCP client is automatically disabled.

With PPPoE support, the PIX Security Appliance is able to provide telecommuters, branch offices, and small businesses with firewall, VPN, and intrusion protection.