
Configuring PPP Services
2-8 117360-A Rev. A
Authenticating the PPP Link: PAP and CHAP
In the authentication phase of PPP initialization, one or both peer routers enable
either Password Authentication Protocol (PAP) or Challenge Handshake
Authentication Protocol (CHAP). Authentication is optional for leased lines but
required for switched (dial-up) lines. You can optionally specify a time limit for
authentication on switched lines.
Password Authentication Protocol
PAP imposes network security by requiring the peer router to send a PAP packet
that contains a plain-text user identifier and password to the originating router
before the interface can advance to the network layer protocol phase.
If PAP fails, the network administrator must change the identifier and password on
both peer routers and disable and reenable LCP to reinitialize the line.
Challenge Handshake Authentication Protocol
CHAP imposes network security by requiring that the peers share a plain-text
secret. The originating peer sends a challenge message to its receiving peer. The
receiving peer responds with a value it calculates on the basis of knowing the
secret. The first peer then matches the response against its own calculation of what
the response should be. If the values match, it sends a success message, and the
LCP establishes the link.
CHAP uses an incrementally changing identifier and a variable challenge value to
provide network security. It also allows for repeated challenges at intervals that
either router on a link can specify. A router may transmit challenge packets not
only during the link establishment phase, but also at any time during the network
layer protocol phase to ensure that the connection retains its integrity.
If CHAP fails, the network administrator must change the identifiers and secret on
both peer routers and disable and reenable LCP to reinitialize the line.
Note: For all dial services, you must use PAP or CHAP, either of which
provides an identification mechanism that is essential to bringing up
dial-on-demand, bandwidth-on-demand, and dial backup lines. Failure of
either authentication protocol causes the connection to be dropped, without the
network administrator’s intervention.
Kommentare zu diesen Handbüchern