This article describes the issue of web authentication not working on the PPPoE interface.

Web authentication does not work on The PPPoE interface. The following configuration does not work for web authentication:

pp0 {
    unit 0 {
        ppp-options {
            chap {
                local-name "test";
                passive;
            }
        }
            pppoe-options {
                underlying-interface ge-0/0/15.0;
                auto-reconnect 10;
                client;
            }
            family inet {
                address 192.168.2.46/29;
                address 192.168.2.45/29 {
                    web-authentication {
                        http;
                    }
                }
            }
        }
    }

Aug 31 12:10:55 httpd-gk setting up mgd socket
Aug 31 12:10:55 Listening for mgd requests on /jail/var/run/mgd_gk
Aug 31 12:10:55 httpd-gk restarting httpd
Aug 31 12:10:55 interface_init: Successfully registered for interface changes.
Aug 31 12:10:55 httpd_ifa_handler: Add message received
Aug 31 12:10:55 Local Address:        
Aug 31 12:10:55 Operation:    1
Aug 31 12:10:55 Address is Up
Aug 31 12:10:55 dev index:    3
Aug 31 12:10:55 sub unit:     0
Aug 31 12:10:55 flags:        0
Aug 31 12:10:55 af:           38
Aug 31 12:10:55 find_webauth_info_by_addr: Searching webauth info for ip address: 1  <<addres not detected
Aug 31 12:10:55 find_webauth_info_by_addr: Could not find winfo for ip address: 1
<strong>Aug 31 12:10:55 process_ifa_add: Added new webauth_info for address 1 into webauth_hash_tbl. Webauth http is Disabled <

The PPPoE interfaces do not support multiple addresses; which are required for web authentication.

The workaround is to use static NAT to NAT the traffic for web authentication. The configuration is as follows:

pp0 {
    unit 0 {
        ppp-options {
            chap {
                local-name "test";
                passive;
            }
        }
            pppoe-options {
                underlying-interface ge-0/0/15.0;
                auto-reconnect 10;
                client;
            }
            family inet {
                address 192.168.2.46/29;
            }
         }
       }
    }

rule webauth {
    match {
        destination-address 192.168.2.48/32;
    }
then {
    static-nat prefix 1.1.1.48/32;
}
 
proxy-arp {
    interface pp0.0 {
        address {
            192.168.2.48/32;
 	}

from-zone Untrust to-zone DMZ {
    policy temp7 {
        match {
            source-address any;
            destination-address any;
            application any;
       }
then {
    permit {
        firewall-authentication {
            web-authentication {
                client-match testuser01;
            }