PPP with CHAP Authentication

PPP (Point-to-Point Protocol) 

PPP (Point-to-Point Protocol) is a protocol for communication between two computers using a serial interface, typically a personal computer connected by phone line to a server. For example, your Internet server provider may provide you with a PPP connection so that the provider's server can respond to your requests, pass them on to the Internet, and forward your requested Internet responses back to you. PPP uses the Internet protocol (IP) (and is designed to handle others). It is sometimes considered a member of the TCP/IP suite of protocols. Relative to the Open Systems Interconnection (OSI) reference model, PPP provides layer 2 (data-link layer) service. Essentially, it packages your computer's TCP/IP packets and forwards them to the server where they can actually be put on the Internet.

PPP is a full-duplex protocol that can be used on various physical media, including twisted pair or fiber optic lines or satellite transmission. It uses a variation of High Speed Data Link Control (HDLC) for packet encapsulation.

PPP is usually preferred over the earlier de facto standard Serial Line Internet Protocol (SLIP) because it can handle synchronous as well as asynchronous communication. PPP can share a line with other users and it has error detection that SLIP lacks. Where a choice is possible, PPP is preferred.
 

CHAP (Challenge-Handshake Authentication Protocol)

CHAP (Challenge-Handshake Authentication Protocol) is a more secure procedure for connecting to a system than the Password Authentication Procedure (PAP). Here's how CHAP works:

1. After the link is made, the server sends a challenge message to the connection requestor. The requestor responds with a value obtained by using a one-way hash function.
2. The server checks the response by comparing it its own calculation of the expected hash value.
3. If the values match, the authentication is acknowledged; otherwise the connection is usually terminated.

At any time, the server can request the connected party to send a new challenge message. Because CHAP identifiers are changed frequently and because authentication can be requested by the server at any time, CHAP provides more security than PAP. RFC1334 defines both CHAP and PAP.

Configuring PPP w/CHAP on a Cisco Router

The interface command to enable ppp is:

encapsulation ppp

Place this on both ends and that is it.  However,  to enable authentication, we need to add the interface command

ppp authentication chap

to both routers,  the routers will now require authentication over the link.  They will attempt to log in with their HOSTNAME as their USERNAME and their ENABLE password as their chap PASSWORD.   We must create an entry in the router that matches the remote routers username and password (global config):

username Other_Router password Other_enable_pass

That is all their is to basic PPP.

Our Samples:

(R1)s0----------s0(R2)

PPP Without CHAP

Router 1:

hostname R1
interface serial 0
    encapsulation PPP
    no shutdown

Router 2:

hostname R2
interface serial 0
    encapsulation PPP
    no shutdown
 

PPP With CHAP default names and password

Router 1:

hostname R1 
enable secret toast1 
username R2 password cool2
interface serial 0
    encapsulation PPP
    ppp authentication chap
    no shutdown

Router 2:

hostname R2
enable secret cool2
username R1 password toast1
interface serial 0
    encapsulation PPP
    ppp authentication chap
    no shutdown
 

Copyright (c) 2001 Boson Software, Inc.  All Rights Reserv