network protocols handbook.pdf

180Protocols GuideWAN - PPP ProtocolsProtocol NameEAP: PPP Extensible AuthenticationProtocolProtocol DescriptionThe PPP Extensible Authentication Protocol (EAP) is for PPPauthentication. EAP supports multiple authentication mechanisms.EAP does not select a specific authentication mechanismat Link Control Phase, but rather postpones this until theAuthentication Phase. This allows the authenticator to requestmore information before determining the specific authenticationmechanism. This also permits the use of a “back-end” serverwhich actually implements the various mechanisms while thePPP authenticator merely passes through the authenticationexchange.1. After the Link Establishment phase is complete, the authenticatorsends one or more Requests to authenticatethe peer. The Request has a type field to indicate whatis being requested. Examples of Request types includeIdentity, MD5-challenge, One-Time Passwords, GenericToken Card, etc. The MD5-challenge type correspondsclosely to the CHAP authentication protocol. Typically,the authenticator will send an initial Identity Requestfollowed by one or more Requests for authenticationinformation. However, an initial Identity Request is notrequired, and MAY be bypassed in cases where theidentity is presumed (leased lines, dedicated dial-ups,etc.).2. The peer sends a Response packet in reply to each Request.The Response packet contains a type field whichcorresponds to the type field of the Request.3. The authenticator ends the authentication phase with aSuccess or Failure packet.The EAP protocol can support multiple authentication mechanismswithout having to pre-negotiate a particular one duringLCP Phase. Certain devices (e.g. an NAS) do not necessarilyhave to understand each request type and may be able tosimply act as a passthrough agent for a “back-end” server on ahost. The device only need look for the success/failure code toterminate the authentication phase.However, EAP does require the addition of a new authenticationtype to LCP and thus PPP implementations will need to be modifiedto use it. It also strays from the previous PPP authenticationmodel of negotiating a specific authentication mechanism duringLCP.Protocol StructureThe Authentication-Protocol Configuration Option format to negotiatethe EAP Authentication Protocol is shown below:8 16 32bit VariableAuthentication-ProtocolType LengthData• Type - 3• Length - 4• Authentication-Protocol - C227 (Hex) for PPP ExtensibleAuthentication Protocol (EAP)One PPP EAP packet is encapsulated in the Information field ofa PPP Data Link Layer frame where the protocol field indicatestype hex C227 (PPP EAP). The EAP packet format is shownbelow:8 16 32bit VariableCode Identifier Length Data• Code - The Code field identifies the type of EAPpacket.• EAP Codes are assigned as follows: 1 Request; 2Response; 3 Success; 4 Failure.• Identifier - The Identifier field aids in matching responseswith requests.• Length - The Length field indicates the length of theEAP packet including the Code, Identifier, Lengthand Data fields.• Data - The format of the Data field is determined bythe Code field.Related protocolsPPP, CHAPSponsor SourceEAP is defined by IETF (http://www.ietf.org) .Referencehttp://www.javvin.com/protocol/rfc2284.pdfPPP Extensible Authentication Protocol (EAP)