local router in a response message. The local router attempts to match the remote device
’
s name with an
associated secret stored in the local username or remote security server database; it uses the stored secret to
encrypt the original challenge and verify that the encrypted values match.
You can enable CHAP, MS-CHAP, or PAP in any order. If you enable all three methods, the first method
specified is requested during link negotiation. If the peer suggests using the second method, or refuses the
first method, the second method is tried. Some remote devices support only one method. Base the order in
which you specify methods on the remote device
’
s ability to correctly negotiate the appropriate method, and
on the level of data line security you require. PAP usernames and passwords are sent as clear text strings,
which can be intercepted and reused.
If you use a
list-name
value that was not configured with the
aaa authentication ppp
command, then
authentication does not complete successfully and the line does not come up.
Note
Table 49: PPP Authentication Protocols for Negotiation, on page 721
lists the protocols used to negotiate PPP
authentication.
Table 49: PPP Authentication Protocols for Negotiation
Description
Protocol
Enables CHAP on an interface.
chap
Enables Microsoft
’
s version of CHAP (MS-CHAP)
on an interface.
ms-chap
Enables PAP on an interface.
pap
Enabling or disabling PPP authentication does not affect the ability of the local router to authenticate itself to
the remote device.
MS-CHAP is the Microsoft version of CHAP. Like the standard version of CHAP, MS-CHAP is used for
PPP authentication. In this case, authentication occurs between a personal computer using Microsoft Windows
NT or Microsoft Windows 95 and a Cisco router or access server acting as a network access server.
Enabling or disabling PPP authentication does not affect the local router authenticating itself to the remote
device.
Task ID
Operations
Task ID
read, write
ppp
read, write
aaa
Examples
In this example, CHAP is enabled on POS 0/4/0/1 and uses the authentication list MIS-access:
RP/0/RSP0/CPU0:router#
configure
RP/0/RSP0/CPU0:router(config)#
interface POS 0/4/0/1
Cisco ASR 9000 Series Aggregation Services Router Interface and Hardware Component Command Reference,
Release 5.3.x
721
PPP Commands onthe Cisco ASR 9000 Series Router
ppp authentication