Use case · Wholesale LNS
Terminate a wholesale LAC hand-off as the LNS.
A wholesale or mobile access provider hands you subscriber sessions over L2TP; Netavo BNG is the LNS that answers. The tunnel runs straight over a private NNI, or wrapped in IPsec across untrusted transit; either way the LNS authenticates each PPP session against your RADIUS, assigns an address from your pool and accounts the session — the same control plane whether it runs on bare metal or a VM.
The access network's LAC (a wholesale broadband aggregator, or an MVNO's mobile core) tunnels each subscriber's PPP session to your LNS. You terminate PPP, so you own authentication, addressing, policy and accounting — the access provider only carries the packets.
Over a private NNI with the aggregator the L2TP runs native. Where it crosses the public internet or any untrusted transit, the tunnel is carried inside IPsec instead, and the TCP MSS is clamped to fit the tunnel plus IPsec overhead so subscribers never hit a black-hole MTU. Bring-up and re-dial are handled automatically; a control-plane restart ends and cleanly re-establishes sessions rather than leaving ghosts.
Nothing about the role is special-cased: the LNS reuses the full control plane, so RADIUS CoA/Disconnect, address pools, per-service VRFs and CG-NAT all work exactly as they do for a directly-attached PPPoE subscriber.
Live L2TP tunnels and the PPP sessions riding them, in the management portal.
The LNS listens for the LAC, authenticates PPP with CHAP and hands out addresses from a named pool. Over a private NNI that is the whole story; across untrusted transit an optional ipsec.peers entry wraps the tunnel and sets the MSS clamp. auth and accounting point at RADIUS, and secrets are stored as references, never in the file.
That is the whole role. The same configuration schema drives a directly-attached PPPoE line — only the lns section (plus ipsec, on the untrusted path) is specific to the wholesale hand-off.
Secrets are op:// references, resolved at start-up — never written in the file.
The tunnel to the LAC and its control channel, from the Junos-style CLI.
The PPP sessions riding the tunnel — each authenticated against RADIUS and assigned from the residential pool.
Own the subscriber.
You terminate PPP, so authentication, addressing, QoS, accounting and lawful-intercept are yours — not the access provider's.
Private NNI or public transit.
Run native L2TP over a private NNI, or wrap it in IPsec with an MSS clamp sized to the path when the hand-off crosses the public internet.
No per-tunnel licence.
Scale tunnels and sessions with cores, not purchase orders; a plain VM is a fully supported LNS for smaller hand-offs.
One edge for everything.
The same box can also terminate direct PPPoE/IPoE, run CG-NAT and carry MPLS — the LNS is just one role it plays.
Stand up an LNS against your LAC.
Start a free evaluation on a VM and bring a test tunnel up, or read the L2TP and IPsec guides for the full configuration reference.