Even if all auth protocols are checked in the PPPoE Server but clients doesnt use any encryption ?
if you don’t have a proper user-isolation or port-isolation, any of your customers can set up a fraud PPPoE-Server, which only offers PAP-Authentification.
If another customer within the same broadcast domain want to authenticate, ita PPPoE-Client most probably will hand out its users credentials to the fraud PPPoE Server.
So in general it is strongly suggested to isolate the customers ports agains each other.
thanks for your answer.
What about the data after authentication ? Traffic between the tunnel can be sniffed ?