PPP (with or without PAP or CHAP authentication) is also supported in dialout solutions. An access server utilizes a dialout feature when it initiates a call to a remote device and attempts to start up a transport protocol such as PPP. To use CHAP or PAP, you must be running PPP encapsulation. Note When CHAP is enabled on an interface and a remote device attempts to connect to it, the access server sends a CHAP packet to the remote device. The CHAP packet requests or “challenges” the remote device to respond. The challenge packet consists of an ID, a random number, and the host name of the local device.
When the remote device receives the challenge packet, it concatenates the ID, the remote device’s password, and the random number, and then encrypts all of it using the remote device’s password. The remote device sends the results back to the access server, along with the name associated with the password used in the encryption process. When the access server receives the response, it uses the name it received to retrieve a password stored in its user database. The retrieved password should be the same password the remote device used in its encryption process.
The access server then encrypts the concatenated information with the newly retrieved password--if the result matches the result sent in the response packet, authentication succeeds. The benefit of using CHAP authentication is that the remote device’s password is never transmitted in clear text. This prevents other devices from stealing it and gaining illegal access to the ISP’s network. CHAP transactions occur only at the time a link is established. The access server does not request a password during the rest of the call.
(The local device can, however, respond to such requests from other devices during a call.) When PAP is enabled, the remote device attempting to connect to the access server is required to send an authentication request. If the username and password specified in the authentication request are accepted, the Cisco IOS XE software sends an authentication acknowledgment. After you have enabled CHAP or PAP, the access server will require authentication from remote devices dialing in to the access server. If the remote device does not support the enabled protocol, the call will be dropped. To use CHAP or PAP, you must perform the following tasks: • Enable PPP encapsulation.
• Enable CHAP or PAP on the interface. • For CHAP, configure host name authentication and the secret or password for each remote system with which authentication is required. Enabling PPP Encapsulation To enable PPP encapsulation, use the following command in interface configuration mode: Device(config-if)# encapsulation ppp This command enables PPP on an interface. Configuring Authentication Enabling PPP Encapsulation Configuring Authentication 13