# IPoE Server

> IPoE server on VyOS - IP over Ethernet for ISPs, DHCP, RADIUS authentication, session management and IPv6 support for broadband access

Source: https://opennix.org/en/docs/vyos/services/vyos-ipoe-server/


The IPoE (IP over Ethernet) Server delivers IP packets over Ethernet networks without using PPPoE, for internet service provider scenarios.

## Overview

IPoE is a broadband access method that encapsulates IP datagrams directly into Ethernet frames per RFC 894, without the overhead of PPPoE.

### Benefits of IPoE

- **Simplicity**: Direct encapsulation of IP into Ethernet
- **Performance**: Lower overhead compared to PPPoE
- **Compatibility**: Works with existing DHCP infrastructure
- **Flexibility**: Support for RADIUS and local authentication
- **Scalability**: Suitable for large ISP networks

### Key Capabilities

- Local and RADIUS authentication
- Integration with DHCP for IP address assignment
- IPv4 and IPv6 support
- Bandwidth management
- Accounting via RADIUS
- VLAN-based client isolation
- Prefix delegation for IPv6
- Dynamic authorization (CoA/DM)

VyOS uses **accel-ppp** to implement the IPoE server.

## Basic Configuration

### Minimal Setup

The simplest configuration with local authentication:

```
set service ipoe-server authentication mode 'local'
set service ipoe-server authentication interface eth1.100 mac '00:50:79:66:68:00'
set service ipoe-server gateway-address '192.168.0.1/24'
set service ipoe-server client-ip-pool IPOE-POOL range '192.168.0.2-192.168.0.254'
set service ipoe-server default-pool 'IPOE-POOL'
commit
```

This configuration:
- Authenticates the client by MAC address on interface eth1.100
- Assigns an IP from the pool 192.168.0.2-254
- Uses 192.168.0.1 as the gateway

### Configuration Structure

```
service ipoe-server
  ├── authentication
  │   ├── mode [local|radius|noauth]
  │   ├── interface <name>
  │   │   └── mac <mac-address>
  │   └── radius
  │       └── server <ip>
  ├── gateway-address <ip/prefix>
  ├── client-ip-pool <name>
  │   └── range <start-stop>
  ├── default-pool <name>
  ├── interface <name>
  │   ├── client-subnet <prefix>
  │   └── vlan <id>
  ├── name-server <ip>
  └── ...
```

## Authentication Modes

### Local Authentication

Authentication based on client MAC addresses.

#### Basic Local Authentication

```
set service ipoe-server authentication mode 'local'
set service ipoe-server authentication interface eth1.100 mac '00:50:79:66:68:00'
set service ipoe-server authentication interface eth1.100 mac '00:50:79:66:68:01'
set service ipoe-server authentication interface eth1.100 mac '00:50:79:66:68:02'
commit
```

#### With Different VLANs

```
# VLAN 100
set service ipoe-server authentication mode 'local'
set service ipoe-server authentication interface eth1.100 mac '00:50:79:66:68:00'

# VLAN 200
set service ipoe-server authentication interface eth1.200 mac '00:50:79:66:68:10'

commit
```

### RADIUS Authentication

Centralized authentication through a RADIUS server.

#### Basic RADIUS Configuration

```
set service ipoe-server authentication mode 'radius'
set service ipoe-server authentication radius server 192.168.1.10 key 'secret123'
set service ipoe-server authentication radius source-address '192.168.1.1'
commit
```

#### Multiple RADIUS Servers

```
# Primary RADIUS
set service ipoe-server authentication radius server 192.168.1.10 key 'secret123'
set service ipoe-server authentication radius server 192.168.1.10 priority 1

# Backup RADIUS
set service ipoe-server authentication radius server 192.168.1.11 key 'secret123'
set service ipoe-server authentication radius server 192.168.1.11 priority 2

# Source address for RADIUS requests
set service ipoe-server authentication radius source-address '192.168.1.1'

commit
```

#### RADIUS Timeout and Retry

```
set service ipoe-server authentication radius server 192.168.1.10 key 'secret123'
set service ipoe-server authentication radius server 192.168.1.10 timeout 5
set service ipoe-server authentication radius server 192.168.1.10 fail-time 30
commit
```

Parameters:
- `timeout` - request timeout in seconds (default 3)
- `fail-time` - time in seconds for which the server is marked unavailable after an error

#### RADIUS Accounting

```
set service ipoe-server authentication radius server 192.168.1.10 key 'secret123'
set service ipoe-server authentication radius server 192.168.1.10 acct-port 1813
set service ipoe-server authentication radius accounting-interim-interval 300
commit
```

Parameters:
- `acct-port` - accounting port (default 1813)
- `accounting-interim-interval` - interval for sending interim-update in seconds

#### Dynamic Authorization Extension (CoA/DM)

```
set service ipoe-server authentication radius dynamic-author server 192.168.1.10 key 'coa-secret'
set service ipoe-server authentication radius dynamic-author server 192.168.1.10 port 3799
commit
```

Allows the RADIUS server to:
- Terminate sessions (Disconnect-Message)
- Change session parameters on the fly (Change-of-Authorization)

### No Authentication Mode

Mode without authentication for open networks:

```
set service ipoe-server authentication mode 'noauth'
set service ipoe-server interface eth1
commit
```

**Warning**: Use only in controlled environments!

## IP Address Pools

### Local Address Pools

#### Simple Range

```
set service ipoe-server client-ip-pool POOL1 range '10.0.0.100-10.0.0.200'
set service ipoe-server default-pool 'POOL1'
commit
```

#### Multiple Ranges

```
set service ipoe-server client-ip-pool POOL1 range '10.0.0.100-10.0.0.150'
set service ipoe-server client-ip-pool POOL1 range '10.0.0.200-10.0.0.250'
set service ipoe-server default-pool 'POOL1'
commit
```

#### Subnet-based Pool

```
set service ipoe-server client-ip-pool POOL2 subnet '10.0.1.0/24'
set service ipoe-server default-pool 'POOL2'
commit
```

#### Multiple Pools

```
# Pool for VLAN 100
set service ipoe-server client-ip-pool VLAN100 range '10.0.100.10-10.0.100.254'

# Pool for VLAN 200
set service ipoe-server client-ip-pool VLAN200 range '10.0.200.10-10.0.200.254'

# Default pool
set service ipoe-server default-pool 'VLAN100'

commit
```

### RADIUS IP Allocation

#### Framed-IP-Address

RADIUS returns a specific IP address:

```
# RADIUS attribute
Framed-IP-Address = 10.0.0.100
```

#### Framed-Pool

RADIUS specifies the pool name for IP selection:

```
# RADIUS attribute
Framed-Pool = "POOL1"

# VyOS configuration
set service ipoe-server client-ip-pool POOL1 range '10.0.1.100-10.0.1.200'
```

#### Framed-IP-Netmask

Subnet mask for the client:

```
# RADIUS attributes
Framed-IP-Address = 10.0.0.100
Framed-IP-Netmask = 255.255.255.0
```

## Gateway and Network

### Gateway Address

Gateway for IPoE clients:

```
set service ipoe-server gateway-address '10.0.0.1/24'
commit
```

Format: `<IP>/<prefix>` - address and subnet mask.

### Interface Configuration

#### Basic Interface

```
set service ipoe-server interface eth1
commit
```

#### With VLAN

```
set service ipoe-server interface eth1
set service ipoe-server interface eth1 vlan 100-200
commit
```

VLAN range: the server accepts clients on VLAN 100-200.

#### Client Subnet

Restricting client subnets:

```
set service ipoe-server interface eth1 client-subnet '10.0.0.0/24'
commit
```

Only clients from the specified subnet are accepted.

### Name Servers

DNS servers for clients:

```
set service ipoe-server name-server '8.8.8.8'
set service ipoe-server name-server '8.8.4.4'
commit
```

Or via RADIUS attribute:
```
# RADIUS DNS attribute
MS-Primary-DNS-Server = 8.8.8.8
MS-Secondary-DNS-Server = 8.8.4.4
```

## IPv6 Support

### IPv6 Pool Configuration

#### Basic IPv6 Pool

```
set service ipoe-server client-ipv6-pool POOL-V6 prefix '2001:db8:1::/48' mask '64'
set service ipoe-server client-ipv6-pool POOL-V6 delegate '2001:db8:2::/48' delegation-prefix '56'
commit
```

Parameters:
- `prefix` - address pool for assignment to clients
- `mask` - prefix length for each client
- `delegate` - pool for prefix delegation
- `delegation-prefix` - length of the delegated prefix

#### Usage Example

```
# IPv6 address pool
set service ipoe-server client-ipv6-pool IPV6-POOL prefix '2001:db8:100::/48' mask '64'

# IPv6 prefix delegation pool
set service ipoe-server client-ipv6-pool IPV6-POOL delegate '2001:db8:200::/48' delegation-prefix '56'

# Name servers
set service ipoe-server name-server '2001:4860:4860::8888'
set service ipoe-server name-server '2001:4860:4860::8844'

commit
```

### RADIUS IPv6 Attributes

RADIUS attributes for IPv6:

```
# IPv6 address
Framed-IPv6-Address = 2001:db8:100::1

# IPv6 pool
Stateful-IPv6-Address-Pool = "IPV6-POOL"

# Delegated prefix pool
Delegated-IPv6-Prefix-Pool = "IPV6-DELEGATION-POOL"

# Delegated prefix
Delegated-IPv6-Prefix = 2001:db8:200::/56
```

## Rate Limiting

### Per-Session Rate Limiting

#### Via RADIUS

RADIUS attributes for rate limiting:

```
# Download speed (from server to client)
Filter-Id = "rate-limit=100M"

# Or vendor-specific attributes
Cisco-AVPair = "rate-limit input 100000000"
Cisco-AVPair = "rate-limit output 10000000"
```

#### Local Configuration

```
set service ipoe-server shaper fwmark 1 bandwidth '100mbit'
commit
```

### Traffic Shaping

```
# Rate limit configuration
set service ipoe-server shaper fwmark 1 bandwidth '50mbit'
set service ipoe-server shaper fwmark 2 bandwidth '100mbit'

commit
```

## DHCP Integration

### DHCP Modes

IPoE can operate in several DHCP modes:

#### Mode: DHCP

The IPoE server acts as a DHCP server:

```
set service ipoe-server dhcp-mode 'dhcp'
set service ipoe-server gateway-address '10.0.0.1/24'
set service ipoe-server client-ip-pool POOL1 range '10.0.0.100-10.0.0.200'
commit
```

#### Mode: RADIUS-based

IP is assigned via RADIUS:

```
set service ipoe-server dhcp-mode 'radius'
set service ipoe-server authentication mode 'radius'
set service ipoe-server authentication radius server 192.168.1.10 key 'secret'
commit
```

### DHCP Relay Mode

Forwarding DHCP requests to an external server:

```
set service ipoe-server dhcp-relay server 192.168.1.100
set service ipoe-server interface eth1
commit
```

## Session Management

### Session Limits

#### Max Sessions per MAC

Limiting the number of sessions per MAC address:

```
set service ipoe-server max-sessions-per-mac 1
commit
```

#### Session Timeout

Session timeouts:

```
set service ipoe-server session-timeout 3600
commit
```

Value in seconds. 0 = no timeout.

### RADIUS Session Control

RADIUS attributes for session management:

```
# Session timeout
Session-Timeout = 3600

# Idle timeout
Idle-Timeout = 600

# Max sessions
Max-Sessions = 1
```

## Advanced Features

### Scripting Hooks

Running scripts on events:

```
set service ipoe-server extended-scripts on-change '/config/scripts/ipoe-change.sh'
set service ipoe-server extended-scripts on-down '/config/scripts/ipoe-down.sh'
set service ipoe-server extended-scripts on-up '/config/scripts/ipoe-up.sh'
commit
```

Events:
- `on-up` - when a session comes up
- `on-down` - when a session goes down
- `on-change` - when session parameters change

### SNMP Support

```
set service ipoe-server snmp master-agent
set service ipoe-server snmp description 'IPoE Server'
commit
```

### Log Level

```
set service ipoe-server log level 'info'
commit
```

Levels: `error`, `warn`, `info`, `debug`, `debug2`

### Thread Count

Number of worker threads:

```
set service ipoe-server thread-count 4
commit
```

## Configuration Examples

### ISP Basic Setup

Basic configuration for an internet service provider:

```
# Authentication
set service ipoe-server authentication mode 'radius'
set service ipoe-server authentication radius server 192.168.1.10 key 'RadiusSecret123'
set service ipoe-server authentication radius source-address '192.168.1.1'

# IP pools
set service ipoe-server client-ip-pool SUBSCRIBERS range '10.100.0.1-10.100.255.254'
set service ipoe-server default-pool 'SUBSCRIBERS'

# Gateway
set service ipoe-server gateway-address '10.100.0.1/16'

# DNS
set service ipoe-server name-server '8.8.8.8'
set service ipoe-server name-server '8.8.4.4'

# Interface
set service ipoe-server interface eth2

# RADIUS accounting
set service ipoe-server authentication radius accounting-interim-interval 600

commit
```

### Multi-VLAN ISP

Configuration with multiple VLANs for different subscriber groups:

```
# RADIUS authentication
set service ipoe-server authentication mode 'radius'
set service ipoe-server authentication radius server 192.168.1.10 key 'secret'
set service ipoe-server authentication radius server 192.168.1.11 key 'secret'
set service ipoe-server authentication radius source-address '192.168.1.1'

# IP pools for different VLANs
set service ipoe-server client-ip-pool RESIDENTIAL range '10.1.0.1-10.1.255.254'
set service ipoe-server client-ip-pool BUSINESS range '10.2.0.1-10.2.255.254'
set service ipoe-server client-ip-pool GUEST range '10.3.0.1-10.3.255.254'

# Default pool
set service ipoe-server default-pool 'RESIDENTIAL'

# Gateway addresses
set service ipoe-server gateway-address '10.1.0.1/16'

# Interface with VLANs
set service ipoe-server interface eth2 vlan 100-300

# DNS servers
set service ipoe-server name-server '8.8.8.8'
set service ipoe-server name-server '1.1.1.1'

# Session limits
set service ipoe-server max-sessions-per-mac 2

# Logging
set service ipoe-server log level 'info'

commit
```

### IPv6 Enabled ISP

Full-featured configuration with IPv6:

```
# Authentication
set service ipoe-server authentication mode 'radius'
set service ipoe-server authentication radius server 192.168.1.10 key 'secret'

# IPv4 pool
set service ipoe-server client-ip-pool IPV4-POOL range '10.0.0.1-10.0.255.254'
set service ipoe-server default-pool 'IPV4-POOL'
set service ipoe-server gateway-address '10.0.0.1/16'

# IPv6 pools
set service ipoe-server client-ipv6-pool IPV6-POOL prefix '2001:db8:1::/48' mask '64'
set service ipoe-server client-ipv6-pool IPV6-POOL delegate '2001:db8:2::/48' delegation-prefix '56'

# DNS servers (IPv4 and IPv6)
set service ipoe-server name-server '8.8.8.8'
set service ipoe-server name-server '2001:4860:4860::8888'

# Interface
set service ipoe-server interface eth2

# RADIUS accounting
set service ipoe-server authentication radius accounting-interim-interval 300

# Dynamic authorization
set service ipoe-server authentication radius dynamic-author server 192.168.1.10 key 'coa-secret'
set service ipoe-server authentication radius dynamic-author server 192.168.1.10 port 3799

commit
```

### Local Authentication

Configuration with local authentication for a small number of clients:

```
# Local authentication
set service ipoe-server authentication mode 'local'
set service ipoe-server authentication interface eth2.100 mac '00:11:22:33:44:01'
set service ipoe-server authentication interface eth2.100 mac '00:11:22:33:44:02'
set service ipoe-server authentication interface eth2.100 mac '00:11:22:33:44:03'

# IP pool
set service ipoe-server client-ip-pool LOCAL-POOL range '192.168.100.10-192.168.100.50'
set service ipoe-server default-pool 'LOCAL-POOL'

# Gateway
set service ipoe-server gateway-address '192.168.100.1/24'

# DNS
set service ipoe-server name-server '192.168.100.1'

commit
```

## Operational Commands

### Viewing Sessions

All active sessions:
```
show ipoe-server sessions
```

Output:
```
interface | username      | ip           | ip6                  | calling-sid       | rate-limit    | state
----------+---------------+--------------+----------------------+-------------------+---------------+--------
eth2.100  | user1         | 10.0.0.10    | 2001:db8:1::10/64    | 00:11:22:33:44:01 | 100000/10000  | active
eth2.200  | user2         | 10.0.0.11    |                      | 00:11:22:33:44:02 |               | active
```

Filtering by interface:
```
show ipoe-server sessions interface eth2.100
```

Filtering by username:
```
show ipoe-server sessions username user1
```

### Statistics

Overall server statistics:
```
show ipoe-server statistics
```

Output:
```
uptime: 5d 12h 34m
cpu: 15%
mem(rss/virt): 45/128 MB
core:
  mempool_allocated: 1024
  mempool_available: 512
  thread_count: 4
  thread_active: 2
sessions:
  starting: 0
  active: 25
  finishing: 0
ipoe:
  sessions:
    starting: 0
    active: 25
    finishing: 0
```

### Terminating Sessions

Terminate a session by username:
```
clear ipoe-server sessions username user1
```

Terminate a session by IP:
```
clear ipoe-server sessions ip 10.0.0.10
```

Terminate a session by MAC:
```
clear ipoe-server sessions calling-sid 00:11:22:33:44:01
```

Terminate a session by interface:
```
clear ipoe-server sessions interface eth2.100
```

### Logs

Viewing IPoE logs:
```
show log ipoe-server
```

Real-time monitoring:
```
monitor log | grep ipoe
```

Viewing specific events:
```
show log ipoe-server | grep "session started"
show log ipoe-server | grep "session terminated"
```

### Restarting the Service

```
restart ipoe-server
```

**Caution**: Restarting will terminate all active sessions!

## RADIUS Attributes Reference

### Authentication Attributes

**Access-Request**:
- `User-Name` - client username (usually the MAC address)
- `User-Password` - password (if used)
- `Calling-Station-Id` - client MAC address
- `Called-Station-Id` - server identifier
- `NAS-IP-Address` - NAS IP address (VyOS)
- `NAS-Identifier` - NAS identifier
- `NAS-Port-Type` - Ethernet (15)

**Access-Accept**:
- `Framed-IP-Address` - assigned IP
- `Framed-IP-Netmask` - subnet mask
- `Framed-Pool` - IP pool name
- `Framed-Route` - static routes
- `Session-Timeout` - session timeout
- `Idle-Timeout` - idle timeout
- `Filter-Id` - rate-limit parameters

### Accounting Attributes

**Accounting-Request (Start)**:
- `Acct-Status-Type` - Start
- `User-Name` - username
- `Acct-Session-Id` - session ID
- `Framed-IP-Address` - client IP
- `NAS-IP-Address` - NAS IP

**Accounting-Request (Interim-Update)**:
- `Acct-Status-Type` - Interim-Update
- `Acct-Session-Time` - session time in seconds
- `Acct-Input-Octets` - bytes received
- `Acct-Output-Octets` - bytes sent
- `Acct-Input-Packets` - packets received
- `Acct-Output-Packets` - packets sent
- `Acct-Input-Gigawords` - inbound gigawords
- `Acct-Output-Gigawords` - outbound gigawords

**Accounting-Request (Stop)**:
- `Acct-Status-Type` - Stop
- `Acct-Terminate-Cause` - termination cause
- `Acct-Session-Time` - total session time
- All traffic counters

### Dynamic Authorization

**CoA-Request**:
- Change session parameters on the fly
- `Filter-Id` - change rate-limit

**Disconnect-Request (DM)**:
- Terminate the session
- `User-Name` or `Acct-Session-Id`

### IPv6 Attributes

- `Framed-IPv6-Address` - client IPv6 address
- `Framed-IPv6-Prefix` - IPv6 prefix
- `Delegated-IPv6-Prefix` - delegated IPv6 prefix
- `Stateful-IPv6-Address-Pool` - IPv6 address pool name
- `Delegated-IPv6-Prefix-Pool` - IPv6 delegation pool name

### Vendor-Specific Attributes

Cisco:
```
Cisco-AVPair = "ip:addr-pool=POOL1"
Cisco-AVPair = "rate-limit input 100000000"
Cisco-AVPair = "rate-limit output 10000000"
```

Microsoft:
```
MS-Primary-DNS-Server = 8.8.8.8
MS-Secondary-DNS-Server = 8.8.4.4
```

## Files and Directories

### Configuration

VyOS generates the accel-ppp configuration from the CLI:
- `/run/accel-pppd/ipoe.conf` - runtime configuration

### Logs

- `/var/log/accel-ppp/ipoe.log` - main log file
- Also in syslog: `/var/log/messages`

### PID File

- `/var/run/accel-pppd.ipoe.pid` - process PID

## Troubleshooting

### Clients Cannot Connect

**Check the configuration**:
```
show service ipoe-server
show configuration service ipoe-server
```

**Check the service status**:
```
show ipoe-server statistics
```

If the service is not running:
```
restart ipoe-server
```

**Check the logs**:
```
show log ipoe-server | grep error
show log ipoe-server | grep denied
```

**Check the interfaces**:
```
show interfaces
show interfaces ethernet eth2 vif
```

### RADIUS Problems

**Check RADIUS connectivity**:
```
show log ipoe-server | grep radius
```

Common errors:
- `RADIUS timeout` - server unreachable or wrong address
- `Access-Reject` - invalid credentials or MAC not authorized
- `Invalid response` - wrong shared secret

**Check the RADIUS configuration**:
```
show service ipoe-server authentication radius
```

**Connectivity test**:
```
ping 192.168.1.10
```

**Use tcpdump to debug RADIUS**:
```
sudo tcpdump -i any -n port 1812 or port 1813
```

### Sessions Do Not Come Up

**Check authentication**:
```
show log ipoe-server | grep auth
```

**Check IP pools**:
```
show service ipoe-server client-ip-pool
```

Make sure that:
- The pools contain free addresses
- The default pool is specified correctly
- RADIUS returns a valid pool name (if used)

**Check active sessions**:
```
show ipoe-server sessions
```

### IP Addressing Problems

**Check the gateway**:
```
show service ipoe-server gateway-address
```

**Check routing**:
```
show ip route
```

Make sure the routes for the client subnets are configured correctly.

**On the client, check**:
```bash
ip addr
ip route
ping <gateway>
```

### Performance Issues

**Check the CPU load**:
```
show system cpu
```

**Check the statistics**:
```
show ipoe-server statistics
```

**Increase the thread count if needed**:
```
set service ipoe-server thread-count 8
commit
```

**Check the network interfaces**:
```
show interfaces counters
show interfaces ethernet eth2 statistics
```

Look for errors, drops, and overruns.

### Rate Limiting Not Working

**Check the RADIUS attributes**:
```
show log ipoe-server | grep "rate-limit"
```

**Check the shaper configuration**:
```
show service ipoe-server shaper
```

**Check tc (traffic control)**:
```
sudo tc -s qdisc show dev <interface>
```

### Logging and Debugging

**Enable debug logging**:
```
set service ipoe-server log level 'debug'
commit
```

**Real-time monitoring**:
```
monitor log | grep ipoe
```

**Specific debugging**:
```
show log ipoe-server | grep "session started"
show log ipoe-server | grep "session terminated"
show log ipoe-server | grep "authentication failed"
```

**DHCP debugging**:
```
show log ipoe-server | grep dhcp
```

## Integration with a RADIUS Server

### FreeRADIUS Configuration

Example FreeRADIUS configuration for VyOS IPoE:

**clients.conf**:
```
client vyos-ipoe {
    ipaddr = 192.168.1.1
    secret = secret123
    shortname = vyos-ipoe
    nas_type = other
}
```

**users** (or SQL database):
```
# User with specific IP
user1 Cleartext-Password := "password"
    Framed-IP-Address = 10.0.0.100,
    Framed-IP-Netmask = 255.255.255.0,
    Session-Timeout = 3600

# User with pool
user2 Cleartext-Password := "password"
    Framed-Pool = "POOL1",
    Filter-Id = "rate-limit=100M"

# MAC-based auth
00:11:22:33:44:01 Cleartext-Password := "00:11:22:33:44:01"
    Framed-Pool = "RESIDENTIAL",
    Session-Timeout = 86400
```

### RADIUS Testing

Test with radtest:
```bash
radtest user1 password 192.168.1.10 0 secret123
```

Test MAC authentication:
```bash
echo "User-Name = '00:11:22:33:44:01'" | radclient 192.168.1.10 auth secret123
```

## Best Practices

### 1. IP Addressing Planning

- Reserve enough addresses in the pools
- Use separate pools for different client types
- Document the purpose of each pool
- Avoid overlapping pools

### 2. RADIUS Redundancy

```
set service ipoe-server authentication radius server 192.168.1.10 priority 1
set service ipoe-server authentication radius server 192.168.1.11 priority 2
```

Always configure a backup RADIUS server.

### 3. Accounting and Monitoring

```
set service ipoe-server authentication radius accounting-interim-interval 300
```

Regular interim updates for accurate billing.

### 4. Security

- Use strong RADIUS shared secrets
- Restrict access to RADIUS ports through the firewall
- Use VLAN isolation for clients
- Regularly review logs for suspicious activity

### 5. Scalability

```
set service ipoe-server thread-count 4
```

Tune the number of threads according to the number of CPU cores.

### 6. Logging

```
set service ipoe-server log level 'info'
```

Use `info` for production, `debug` only for troubleshooting.

### 7. Session Management

```
set service ipoe-server max-sessions-per-mac 1
```

Prevents abuse of a single account.

### 8. Backup

Regularly save the configuration:
```
save
```

Store backup copies:
```
save /config/backup/ipoe-config-$(date +%Y%m%d).boot
```

### 9. Performance Monitoring

Regularly check:
```
show ipoe-server statistics
show system cpu
show system memory
```

### 10. Testing Before Deployment

- Test on a small number of clients
- Verify all scenarios (connection, disconnection, reconnection)
- Verify the accounting data
- Load testing

## Migration from PPPoE to IPoE

### Benefits of Migration

- Reduced overhead (MTU issues)
- Simplified client configuration
- Better performance
- Compatibility with modern devices

### Migration Plan

1. **Preparation**:
   - Update the RADIUS schema if needed
   - Prepare new IP pools
   - Train support staff

2. **Parallel Run**:
   - Run IPoE on separate VLANs
   - Gradually migrate clients
   - Monitor for issues

3. **Transition**:
   - Notify clients
   - Provide configuration instructions
   - Support during migration

4. **Completion**:
   - Disable PPPoE after full migration
   - Clean up old configurations

## Next Steps

- [PPPoE Server](/docs/vyos/services/vyos-pppoe-server/) - alternative to IPoE
- [DHCP Server](/docs/vyos/services/vyos-dhcp/) - DHCP integration
- [RADIUS](https://freeradius.org/) - configuring a RADIUS server
- [IPv6](/docs/vyos/system/vyos-ipv6/) - advanced IPv6 configuration
- [QoS](/docs/vyos/qos/) - traffic management