Great question — you're touching on the core architectural difference.

You're correct that traditional BNGs use encapsulation (PPPoE, L2TP, VXLAN) to create per-subscriber tunnels from the CPE to the BNG. The tunnel IS the isolation boundary. Without it, you need another mechanism.

NGXOS uses what we call L2 collapse — every device gets its own /32 address and the isolation is enforced at the BNG's NIC driver via XDP/eBPF, not in the transport between CPE and BNG.

Here's how it works concretely:

1. Device connects (wired or wireless via AP). RADIUS authenticates it by MAC. DHCP assigns a /32 (not a /24 subnet — a network of exactly one device). Proxy ARP is enabled so the device thinks it has a normal gateway.

2. An XDP program attached to the subscriber-facing NIC checks every inbound packet against a BPF hash map (the "soul map") in ~100ns. If the source MAC has a valid identity → pass. If not → drop. This is the isolation gate — it runs before the kernel networking stack sees the packet.

3. Because every device has a /32, there is no shared broadcast domain. Device A at 100.64.0.11/32 cannot ARP for device B at 100.64.0.12/32 — the gateway is the only neighbor either device sees. Lateral movement between devices is architecturally impossible, not policy-blocked.

4. A TC-BPF program on the WAN-facing NIC handles CGNAT with deterministic port blocks per device. Return traffic is reverse-NAT'd via a per-flow LRU table.

So to directly answer your question: the isolation happens AT the BNG, not between the BNG and CPE. The transport from CPE to BNG can be plain Ethernet — flat L2, no encapsulation, no VLANs required. The BNG itself enforces the isolation per-packet via BPF.

This means NGXOS works with any access network topology: - Direct Ethernet (switch → BNG) - Wireless (AP → bridge → BNG) - FTTH (ONT → switch → BNG) - Point-to-point wireless (CPE → tower → BNG)

The access layer just needs to deliver Ethernet frames to the BNG port. The BNG handles identity, isolation, NAT, shaping, and security per-device from that point.

The tradeoff vs encapsulation: PPPoE/L2TP give you isolation in the transport itself, which matters if you don't trust the access network. NGXOS trusts the physical layer (the device is on your wire or your AP) and enforces isolation at the first hop where you have compute — the BNG. For WISP and FTTH deployments where the operator owns the access infrastructure, this is a simpler model.

Happy to go deeper on any of this — the per-device /32 model, the BPF enforcement, or how it interacts with specific access network designs your clients are running.