31 Days Before Your CCNA Exam

Day 3 333PPP MultilinkIn a redundant configuration between two routers, the routers use Layer 3 load balancing alternatingtraffic between the two links, which does not always result in truly balanced sharing of the traffic.Multilink PPP load-balances the traffic equally over the links while allowing the Layer 3 logic in eachrouter to treat the parallel links as a single link. When encapsulating a packet, PPP fragments the packetinto smaller frames, sending one fragment over each link. Multilink PPP allows the Layer 3 routingtables to use a single route that refers to the combined links, keeping the routing table smaller.PPP AuthenticationPAP and CHAP authenticate the endpoints on either end of a point-to-point serial link. CHAP isthe preferred method today because the identification process uses values hidden with a MessageDigest 5 (MD5) one-way hash, which is more secure than the clear-text passwords sent by PAP.Figure 3-3 shows the different processes used by PAP and CHAP. With PAP, the username andpassword are sent in the first message. With CHAP, the protocol begins with a message called achallenge, which asks the other router to send its username and password.Figure 3-3PPP Authentication ProtocolsCentral-site RouterR1PAP2-Way HandshakeUsername: R1Password: cisco123Remote RouterR3Accept/RejectCentral-site RouterR1CHAP3-Way HandshakeChallengeUsername: R1Password: cisco123Remote RouterR3Accept/RejectPAP is much less secure than CHAP because PAP sends the hostname and password in clear textin the message. CHAP instead uses a one-way hash algorithm, with input to the algorithm being apassword that never crosses the link, plus a shared random number. The CHAP challenge states therandom number; both routers are preconfigured with the password. The challenged router runs thehash algorithm using the just-learned random number and the secret password and sends theresults back to the router that sent the challenge. The router that sent the challenge runs the samealgorithm using the random number (sent across the link) and the password (not sent across thelink). If the results match, the passwords must match. With the random number, the hash value isdifferent every time.