CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

PPP Authentication Configuration
- Authentication allows a device to ensure that it is communicating with the correct device.
Authentication is normally being initiated by the called party.
- The 2 authentication protocols that can be used on PPP links are Password Authentication
Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP).
- PAP sends the username and password in clear text (very insecure) across a PPP link in the first
message during the link establishment phase.
- During the PAP authentication phase, the calling device will sends its username (or hostname)
and password to the called device. The called device compares this information with a list of
locally stored usernames and passwords and will reply with an accept or reject message
accordingly. PAP is a two-way handshake mechanism.
- CHAP does not send passwords directly; CHAP passwords are exchanged as MD5 hash values.
The authentication phase takes place after the link establishment phase. CHAP begins with a
challenge message, which states a random number. The challenged router (2nd router) replies
with a calculated Message Digest 5 (MD5) one-way hash result based on the password and the
random number. The 1st router calculates the same hash result with the same set of password and
random number, and compares its result with the result replied from the challenged router.
CHAP is a three-way handshake mechanism.
- PPP authentication is defined as a one-way authentication method (the ppp authentication
{pap | chap} command can be just issued on either end of a PPP link). However, two-way
authentication can be achieved by issuing the ppp authentication command on both ends.
- one-way authentication is the minimum possible authentication. The called party verifies the
identity of the calling party. Also known as unidirectional authentication.
two-way authentication is where the calling party can also verify the identity of the called party.
Also known as bidirectional authentication.
- If both PAP and CHAP are enabled with the ppp authentication {chap pap | pap chap}
interface subcommand, the 1st method specified is used. If another peer suggests the 2nd method
or refuses the 1st method, the 2nd method is used.
- For one-way PAP authentication, the username {remote-hostname} password {passwd}
statement is only required on the called device to verify the username and password sent by the
calling device; whereas for two-way PAP authentication, it is required on both devices.
- The username password statement is required on both devices for both unidirectional and
bidirectional CHAP authentication. In unidirectional CHAP authentication (a local device
authenticating a remote device), it is first used by the remote device (RT2) to response to the
challenge generated by the local device (RT1), and then used by the local device (RT1) to verify
the response from the remote device (RT2).
- In PPP authentication configuration, the hostname of the remote router will be configured as the
username on the local router, and the same shared secret password will be configured on both
routers. Note: Passwords are case sensitive but usernames are not case-sensitive.
155
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com