Hello Brian,Can you explain how PPP over Frame Relay works? Also what are the advantages and disadvantages of using it over normal Frame Relay configuration?Thanks and regards,


Hi Yaser,

Frame Relay does not natively support features such as authentication, link quality monitoring, and reliable transmission. Based on this it is sometimes advantageous to encapsulate an additional PPP header between the normal layer 2 Frame Relay encapsulation and the layer 3 protocol. By running PPP over Frame Relay (PPPoFR) we can then implement authentication of Frame Relay PVCs, or even bind multiple PVCs together using PPP Multilink.

PPPoFR is configure in Cisco IOS through the usage of a Virtual-Template interface. A Virtual-Template is a PPP encapsulated interface that is designed to spawn a “template” of configuration down to multiple member interfaces. The traditional usage of this interface has been on dial-in access servers, such as the AS5200, to support multiple PPP dialin clients terminating their connection on a single interface running IP.

The first step in configuring PPPoFR is to create the Virtual-Template interface. This interface is where all logical options, such as IP address and PPP authentication will be configured. The syntax is as follows:

interface Virtual-Template1
 ip address
 ppp chap hostname ROUTER6
 ppp chap password 0 CISCO

Note the lack of the “encapsulation ppp” command on the Virtual-Template. This command is not needed as a Virtual-Template is always running PPP. This can be seen by looking at the “show interface virtual-template1” output in the IOS. Additionally in this particular case the remote end of this connection will be challenging the router to authenticate via PPP CHAP. The “ppp chap” subcommands have instructed the router to reply with the username ROUTER6 and an MD5 hash value of the PPP magic number and the password CISCO.

Our next step is to configure the physical Frame Relay interface, and to bind the Virtual-Template to the Frame Relay PVC. This is accomplished as follows:

interface Serial0/0
 encapsulation frame-relay
 frame-relay interface-dlci 201 ppp Virtual-Template1

Note that the “no frame-relay inverse-arp” command is not used on this interface. Since our IP address is located on the Virtual-Template interface the Frame Relay process doesn’t actually see IP running over the link. Instead it simply sees a PPP header being encapsulated on the link, while the IPCP protocol of PPP takes care of all the IP negotiation for us. Note that the order that these steps are performed in is significant. If a Virtual-Template interface is applied to a Frame Relay PVC before it is actually created you may see difficulties with getting the link to become active.

Also when using a Virtual-Template interface it’s important to understand that a Virtual-Access “member” interface is cloned from the Virtual-Template interface when the PPP connection comes up. Therefore the Virtual-Template interface itself will always be in the down/down state. This can affect certain network designs such as using the backup interface command on a Virtual-Template. In our particular case we can see from the below output this effect:

R6#show ip interface brief | include
Virtual-Access1 YES TFTP up up
Virtual-Template1 YES manual down down

Aside from this there is no other configuration that directly relates to Frame Relay for PPP. Other options such as authentication, reliability, and multilink would be configured under the Virtual-Template interface.

About Brian McGahan, CCIE #8593, CCDE #2013::13:

Brian McGahan was one of the youngest engineers in the world to obtain the CCIE, having achieved his first CCIE in Routing & Switching at the age of 20 in 2002. Brian has been teaching and developing CCIE training courses for over 10 years, and has assisted thousands of engineers in obtaining their CCIE certification. When not teaching or developing new products Brian consults with large ISPs and enterprise customers in the midwest region of the United States.

Find all posts by Brian McGahan, CCIE #8593, CCDE #2013::13 | Visit Website

You can leave a response, or trackback from your own site.

22 Responses to “Understanding PPP over Frame Relay (PPPoFR)”

  1. Dan K says:

    Just wanted to say that these blog entries have been very informative. This is a great idea — please keep them coming!

  2. Dara says:

    Yup Dan,

    Indeed a good explanation.

    just a query,
    1>Can we generalize all the advantages that are given by the PPP header on FR to be similarly applicable for Ethernet & ATM media i.e, PPPOE/PPPOA?

    2>As well the procedure to make them operational, is there any significant operational difference on other mentioned media types?

    Thanks a lot for the contribution !!!

  3. [...] Internetwork Expert Blog: Understanding PPP over Frame Relay (PPPoFR)- a great tutorial on PPPoFR, including when and why you would use it in the “real world.” [...]

  4. Olu says:

    Yes this quite good and straight to the point.

    We appreciate the effort IE has made to setup this blog.

    Thanks !

  5. Hi Dara,

    Yes the same advantages apply to running PPP over ATM or Ethernet. PPP is run over Ethernet generally in DSL environments to allow the service provider to authenticate the end client.



  6. Yaser says:

    Thanks Brian , that realy help.


  7. Jack says:

    Just wanted to say that these blog entries have been very informative, to me thanks a lot.

  8. Kev of ST says:

    Great Blog,very helpful indeed…

  9. Rupesh says:

    Hi, Is any setting required on FR Switch for PPP over Templete. I am seeing that I am able to ping all the interfaces and EIGRP neighbor also established. But I am not seeing any advertised routes on any router. Please help.

  10. 'wale says:


    Do I have to create a virtual template for RIP authentication over a FR link?

    Does this apply to other routing protocols as well? Thanks

  11. cyclodextrin says:

    One point thats not mentioned is that a corresponding username must be created on each router otherwise authentication will not succeed.

    i.e. username r1 password 0 cisco

  12. Gus says:

    I have PPPoFR running on a cisco 1700 (pretty old series), virtual template is configured properly, I have 2 T1′s bonded in a PPP multilink.I do not own the frame relay switch (ISP does). On the physical interfaces serial 1 (access-member 1 is up/up) serial 0 (access member 2 is up/down) if I do a shut no shut on this interface it becomes up/up and after 10 seconds goes back to up/down. The output of the show frame-relay pvc command shows pvc=active for serial 1 and deleted for serial 2, if I use the no keepalive command under the up/down interface (serial 0) and shut no shut it stays up/up but no traffic goes through, the show FR lmi command displays that this IF has not received a reply in 5 weeks, but the last request was 2 seconds ago. Is there any other explanation for this than ISP deleted their end of the PVC for the T1 that is connected to serial 0?

  13. Gus says:

    Also I was working with the ISP on this, because they state that their end of the PVC has not been deleted (which I don’t think so) and they shutdown and turned back on the T1 from their end while I had term monitor on my router. I saw the interface go down/down and then back up/up and after 10 seconds go back to up/down, that proves that the WIC is fine and there is physical connectivity to the ISP.

  14. abdul says:

    what is the configuration for the ppp Over using FR authentication with pap

  15. Syed says:

    Hi Brian,

    you saved my day man.


  16. Gene says:

    “frame-relay interface-dlci 201 ppp Virtual-Template1″,if configure the wrong dlci number ,then the ppp link will down.After that,I reconfigure the above command with the correct dlci number ,but the virtual-access also down …In the way ,how to fix it ???

  17. Comp Geek says:

    Brian – Thank you so much!!!

  18. Ahmed says:

    owsam! thank u sir

  19. mad says:

    Hi Brian, it is possible to use IPCP in PPP over Frame Relay?

    R3(config)#interface Virtual-Template10
    R3(config-if)#peer default ip address ?
    dhcp Use DHCP proxy client mechanism to allocate a peer IP address
    dhcp-pool Use local DHCP pools to allocate a peer IP address
    pool Use IP pool mechanism to allocate a peer IP address

    I cannot assign an IP address directy to the peer…
    Thank you,


Leave a Reply


CCIE Bloggers