Unidirectional PPP CHAP Authentication

This lab demonstrates the mechanisms of unidirectional (one-way) PPP CHAP authentication. Below describes the situation of the initial lab setup:
i) Both routers have no username and PPP authentication configurations.
ii) Both routers can ping each other.
iii) Both routers have enabled PPP authentication debugging with debug ppp authentication.

The username - password statement is required on both devices for both unidirectional and bidirectional CHAP authentication. In unidirectional CHAP authentication (a local device authenticating a remote device), it is first used by the remote device (RT1) to response to the challenge generated by the local device (RT2), and then used by the local device (RT2) to verify the response from the remote device (RT1).

Below enable PPP CHAP authentication on RT2. The debugging messages show RT2 challenges RT1 but RT1 is unable to response to RT2’s challenge.

RT2(config)#int s0/0
RT2(config-if)#ppp authentication chap
RT2(config-if)#
00:15:52: Se0/0 CHAP: O CHALLENGE id 1 len 24 from "RT2"
00:15:53: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to down
00:15:54: Se0/0 CHAP: O CHALLENGE id 2 len 24 from "RT2"
00:15:56: Se0/0 CHAP: O CHALLENGE id 3 len 24 from "RT2"
----------------------------------------------------------------------
RT1#
00:15:52: Se0/0 CHAP: I CHALLENGE id 1 len 24 from "RT2"
00:15:52: Se0/0 CHAP: Username RT2 not found
00:15:52: Se0/0 CHAP: Unable to authenticate for peer
00:15:52: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to down
00:15:54: Se0/0 PPP: Using default call direction
00:15:54: Se0/0 PPP: Treating connection as a dedicated line
00:15:54: Se0/0 CHAP: I CHALLENGE id 2 len 24 from "RT2"
00:15:54: Se0/0 CHAP: Username RT1 not found
00:15:54: Se0/0 CHAP: Unable to authenticate for peer
00:15:56: Se0/0 CHAP: I CHALLENGE id 3 len 24 from "RT2"
00:15:56: Se0/0 CHAP: Username RT1 not found
00:15:56: Se0/0 CHAP: Unable to authenticate for peer

Below configure the username and password on RT1. The debugging message show RT1 is able to response to RT2’s challenge but RT2 is unable to validate RT1’s response.

RT1(config)#username RT2 password cisco123
RT1(config)#
00:18:24: Se0/0 CHAP: I CHALLENGE id 67 len 24 from "RT2"
00:18:24: Se0/0 CHAP: O RESPONSE id 67 len 24 from "RT1"
00:18:24: Se0/0 CHAP: I FAILURE id 67 len 26 msg is "Authentication failure"
00:18:26: Se0/0 CHAP: I CHALLENGE id 68 len 24 from "RT2"
00:18:26: Se0/0 CHAP: O RESPONSE id 68 len 24 from "RT1"
00:18:26: Se0/0 CHAP: I FAILURE id 68 len 26 msg is "Authentication failure”
----------------------------------------------------------------------
RT2#
00:18:24: Se0/0 CHAP: O CHALLENGE id 67 len 24 from "RT2"
00:18:24: Se0/0 CHAP: I RESPONSE id 67 len 24 from "RT1"
00:18:24: Se0/0 CHAP: Unable to validate Response.  Username RT1 not found
00:18:24: Se0/0 CHAP: O FAILURE id 67 len 26 msg is "Authentication failure"
00:18:26: Se0/0 CHAP: O CHALLENGE id 68 len 24 from "RT2"
00:18:26: Se0/0 CHAP: I RESPONSE id 68 len 24 from "RT1"
00:18:26: Se0/0 CHAP: Unable to validate Response.  Username RT1 not found
00:18:26: Se0/0 CHAP: O FAILURE id 68 len 26 msg is "Authentication failure"

Note: The alternative configuration on RT1 is the ppp chap hostname RT1 and ppp chap password cisco123 interface subcommands.

Below configure the username and password on RT2 for RT2 to validate RT1’s response.
Finally the unidirectional (one-way) PPP CHAP authentication is successful.

RT2(config)#username RT1 password cisco123
RT2(config)#
00:20:54: Se0/0 CHAP: O CHALLENGE id 127 len 24 from "RT2"
00:20:54: Se0/0 CHAP: I RESPONSE id 127 len 24 from "RT1"
00:20:54: Se0/0 CHAP: O SUCCESS id 127 len 4
00:20:54: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to up
----------------------------------------------------------------------
RT1#
00:20:48: Se0/0 CHAP: I CHALLENGE id 127 len 24 from "RT2"
00:20:48: Se0/0 CHAP: O RESPONSE id 127 len 24 from "RT1"
00:20:48: Se0/0 CHAP: I SUCCESS id 127 len 4
00:20:49: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to up
00:20:50: Se0/0 PPP: Using default call direction
00:20:50: Se0/0 PPP: Treating connection as a dedicated line

LCP packets are sent during the PPP link establishment phase. These packets contain several Configuration Option fields that allow PPP devices to negotiate how they want the link to be established – the maximum datagram size the link can carry, authentication, quality monitoring, and compression. If no Configuration Option field is present, the default configurations are used.

Unidirectional PPP PAP Authentication

Unidirectional PPP PAP authentication configuration on Client:

interface Serial0/0
 ip address 10.10.10.1 255.255.255.252
 encapsulation ppp
 ppp direction callout
 ppp pap sent-username Client password 0 cisco

Note: The ppp authentication pap interface subcommand is not required on Client.

Unidirectional PPP PAP authentication configuration on NAS:

username Client password 0 cisco
!
interface Serial0/0
 ip address 10.10.10.2 255.255.255.252
 encapsulation ppp
 ppp authentication pap [callin]
 ppp direction callin

Note: The callin keyword of the ppp authentication pap interface subcommand is optional

A router configured with the ppp authentication pap interface subcommand will use PAP to verify the identity of the peer, which means that the peer must present its username and password to the local device for verification. The local device would use the local username-based authentication system to verify and authenticate its peer.

The function of the username {remote-username} password {passwd} statement is different for PAP and CHAP. With PAP, it is only used to verify that an incoming username and password are valid; whereas CHAP uses it to generate the response to a challenge and verify a response.

For one-way PAP authentication, the username {remote-hostname} password {passwd} statement is only required on the called device to verify the username and password sent by the calling device; whereas for two-way PAP authentication, it is required on both devices.

A router configured with the ppp authentication pap callin interface subcommand configured will only authenticate the peer during incoming calls – it will not authenticate the peer for outgoing calls.

The ppp pap sent-username {local-username} password {passwd} interface subcommand is configured on the calling device to authenticate itself to a remote called device. The remote device must have the same set of username – password statement configured.

The ppp direction {callin | callout | dedicated} interface subcommand is introduced in Cisco IOS Release 12.2T. This command is useful when a router is connected to an interface type where there is no inherent call direction, eg: a back-to-back or leased-line connection.

Below shows the output of the PPP authentication debug messages for a successful unidirectional PAP authentication on Client:

Client#sh debug
PPP:
  PPP authentication debugging is on
  PPP protocol negotiation debugging is on

Client#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Client(config)#int s1/0
Client(config-if)#no shut
Client(config-if)#
00:07:14: %LINK-3-UPDOWN: Interface Serial0/0, changed state to up
00:07:14: Se0/0 PPP: Using configured call direction
00:07:14: Se0/0 PPP: Treating connection as a callout
00:07:14: Se0/0 PPP: Session handle[5A000003] Session id[25]
00:07:14: Se0/0 PPP: Phase is ESTABLISHING, Active Open
00:07:14: Se0/0 PPP: Authorization required
00:07:14: Se0/0 PPP: No remote authentication for call-out
00:07:14: Se0/0 LCP: O CONFREQ [Closed] id 25 len 10
00:07:14: Se0/0 LCP:    MagicNumber 0x0013D707 (0x05060013D707)
00:07:14: Se0/0 LCP: I CONFREQ [REQsent] id 83 len 14
00:07:14: Se0/0 LCP:    AuthProto PAP (0x0304C023)
00:07:14: Se0/0 LCP:    MagicNumber 0x0113BFC6 (0x05060113BFC6)
00:07:14: Se0/0 LCP: O CONFACK [REQsent] id 83 len 14
00:07:14: Se0/0 LCP:    AuthProto PAP (0x0304C023)
00:07:14: Se0/0 LCP:    MagicNumber 0x0113BFC6 (0x05060113BFC6)
00:07:14: Se0/0 LCP: I CONFACK [ACKsent] id 25 len 10
00:07:14: Se0/0 LCP:    MagicNumber 0x0013D707 (0x05060013D707)
00:07:14: Se0/0 LCP: State is Open
00:07:14: Se0/0 PPP: No authorization without authentication
00:07:15: Se0/0 PPP: Phase is AUTHENTICATING, by the peer
00:07:15: Se0/0 PAP: Using hostname from interface PAP
00:07:15: Se0/0 PAP: Using password from interface PAP
00:07:15: Se0/0 PAP: O AUTH-REQ id 25 len 17 from "Client"
00:07:15: Se0/0 PAP: I AUTH-ACK id 25 len 5
00:07:15: Se0/0 PPP: Phase is FORWARDING, Attempting Forward
00:07:15: Se0/0 PPP: Queue IPCP code[1] id[1]
00:07:15: Se0/0 PPP: Phase is ESTABLISHING, Finish LCP
00:07:15: Se0/0 PPP: Phase is UP
00:07:15: Se0/0 IPCP: O CONFREQ [Closed] id 1 len 10
00:07:15: Se0/0 IPCP:    Address 10.10.10.1 (0x03060A0A0A01)
00:07:15: Se0/0 CDPCP: O CONFREQ [Closed] id 1 len 4
00:07:15: Se0/0 PPP: Process pending ncp packets
00:07:15: Se0/0 IPCP: Redirect packet to Se1/0
00:07:15: Se0/0 IPCP: I CONFREQ [REQsent] id 1 len 10
00:07:15: Se0/0 IPCP:    Address 10.10.10.2 (0x03060A0A0A02)
00:07:15: Se0/0 IPCP: O CONFACK [REQsent] id 1 len 10
00:07:15: Se0/0 IPCP:    Address 10.10.10.2 (0x03060A0A0A02)
00:07:15: Se0/0 CDPCP: I CONFREQ [REQsent] id 1 len 4
00:07:15: Se0/0 CDPCP: O CONFACK [REQsent] id 1 len 4
00:07:15: Se0/0 IPCP: I CONFACK [ACKsent] id 1 len 10
00:07:15: Se0/0 IPCP:    Address 10.10.10.1 (0x03060A0A0A01)
00:07:15: Se0/0 IPCP: State is Open
00:07:15: Se0/0 IPCP: Add link info for cef entry 10.1.1.2
00:07:15: Se0/0 IPCP: Install route to 10.1.1.2
00:07:15: Se0/0 CDPCP: I CONFACK [ACKsent] id 1 len 4
00:07:15: Se0/0 CDPCP: State is Open
00:07:16: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to up
Client(config-if)#

Below shows the output of the PPP authentication debug messages for a successful unidirectional PAP authentication on NAS:

NAS#
00:07:08: Se0/0 LCP: I CONFREQ [Listen] id 25 len 10
00:07:08: Se0/0 LCP:    MagicNumber 0x0013D707 (0x05060013D707)
00:07:08: Se0/0 PPP: Authorization required
00:07:08: Se0/0 LCP: O CONFREQ [Listen] id 83 len 14
00:07:08: Se0/0 LCP:    AuthProto PAP (0x0304C023)
00:07:08: Se0/0 LCP:    MagicNumber 0x0113BFC6 (0x05060113BFC6)
00:07:08: Se0/0 LCP: O CONFACK [Listen] id 25 len 10
00:07:08: Se0/0 LCP:    MagicNumber 0x0013D707 (0x05060013D707)
00:07:09: Se0/0 LCP: I CONFACK [ACKsent] id 83 len 14
00:07:09: Se0/0 LCP:    AuthProto PAP (0x0304C023)
00:07:09: Se0/0 LCP:    MagicNumber 0x0113BFC6 (0x05060113BFC6)
00:07:09: Se0/0 LCP: State is Open
00:07:09: Se0/0 PPP: Phase is AUTHENTICATING, by this end
00:07:09: Se0/0 PAP: I AUTH-REQ id 25 len 17 from "Client"
00:07:09: Se0/0 PAP: Authenticating peer Client
00:07:09: Se0/0 PPP: Phase is FORWARDING, Attempting Forward
00:07:09: Se0/0 PPP: Phase is AUTHENTICATING, Unauthenticated User
00:07:09: Se0/0 PPP: Sent PAP LOGIN Request
00:07:09: Se0/0 PPP: Received LOGIN Response PASS
00:07:09: Se0/0 PPP: Phase is FORWARDING, Attempting Forward
00:07:09: Se0/0 PPP: Phase is AUTHENTICATING, Authenticated User
00:07:09: Se0/0 PPP: Sent LCP AUTHOR Request
00:07:09: Se0/0 PPP: Sent IPCP AUTHOR Request
00:07:09: Se0/0 LCP: Received AAA AUTHOR Response PASS
00:07:09: Se0/0 IPCP: Received AAA AUTHOR Response PASS
00:07:09: Se0/0 PAP: O AUTH-ACK id 25 len 5
00:07:09: Se0/0 PPP: Phase is UP
00:07:09: Se0/0 IPCP: O CONFREQ [Closed] id 1 len 10
00:07:09: Se0/0 IPCP:    Address 10.10.10.2 (0x03060A0A0A02)
00:07:09: Se0/0 PPP: Sent CDPCP AUTHOR Request
00:07:09: Se0/0 PPP: Process pending ncp packets
00:07:09: Se0/0 CDPCP: Received AAA AUTHOR Response PASS
00:07:09: Se0/0 CDPCP: O CONFREQ [Closed] id 1 len 4
00:07:09: Se0/0 IPCP: I CONFREQ [REQsent] id 1 len 10
00:07:09: Se0/0 IPCP:    Address 10.10.10.1 (0x03060A0A0A01)
00:07:09: Se0/0 AAA/AUTHOR/IPCP: Start.  Her address 10.1.1.1, we want 0.0.0.0
00:07:09: Se0/0 PPP: Sent IPCP AUTHOR Request
00:07:09: Se0/0 AAA/AUTHOR/IPCP: Reject 10.1.1.1, using 0.0.0.0
00:07:09: Se0/0 AAA/AUTHOR/IPCP: Done.  Her address 10.1.1.1, we want 0.0.0.0
00:07:09: Se0/0 IPCP: O CONFACK [REQsent] id 1 len 10
00:07:09: Se0/0 IPCP:    Address 10.10.10.1 (0x03060A0A0A01)
00:07:09: Se0/0 CDPCP: I CONFREQ [REQsent] id 1 len 4
00:07:09: Se0/0 CDPCP: O CONFACK [REQsent] id 1 len 4
00:07:09: Se0/0 IPCP: I CONFACK [ACKsent] id 1 len 10
00:07:09: Se0/0 IPCP:    Address 10.10.10.2 (0x03060A0A0A02)
00:07:09: Se0/0 IPCP: State is Open
00:07:09: Se0/0 CDPCP: I CONFACK [ACKsent] id 1 len 4
00:07:09: Se0/0 CDPCP: State is Open
00:07:09: Se0/0 IPCP: Add link info for cef entry 10.1.1.1
00:07:09: Se0/0 IPCP: Install route to 10.1.1.1
00:07:10: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to up
NAS#

Below shows the output of the PPP authentication debug messages for a failed unidirection PAP authentication (wrong username - password statement configured on NAS) on Client and NAS:

Client(config-if)#no shut
Client(config-if)#
00:12:38: Se0/0 PPP: Phase is ESTABLISHING, Passive Open
00:12:38: Se0/0 LCP: State is Listen
00:12:38: Se0/0 LCP: State is Open
00:12:38: Se0/0 PPP: No authorization without authentication
00:12:38: Se0/0 PPP: Phase is AUTHENTICATING, by the peer
00:12:38: Se0/0 PAP: Using hostname from interface PAP
00:12:38: Se0/0 PAP: Using password from interface PAP
00:12:38: Se0/0 PAP: O AUTH-REQ id 40 len 17 from "Client"
00:12:39: Se0/0 PAP: I AUTH-NAK id 40 len 26 msg is "Authentication failed"
00:12:39: Se0/0 LCP: I TERMREQ [Open] id 134 len 4
00:12:39: Se0/0 LCP: O TERMACK [Open] id 134 len 4
00:12:39: Se0/0 PPP: Sending Acct Event[Down] id[29]
00:12:39: Se0/0 PPP: Phase is TERMINATING
00:12:41: Se0/0 LCP: TIMEout: State TERMsent
00:12:41: Se0/0 LCP: State is Closed
00:12:41: Se0/0 PPP: Phase is DOWN
--------------------------------------------------
NAS#
00:12:30: Se0/0 PPP: Phase is ESTABLISHING, Passive Open
00:12:30: Se0/0 LCP: State is Listen
00:12:32: Se0/0 LCP: TIMEout: State Listen
00:12:32: Se0/0 PPP: Authorization required
00:12:32: Se0/0 LCP: State is Open
00:12:32: Se0/0 PPP: Phase is AUTHENTICATING, by this end
00:12:32: Se0/0 PAP: I AUTH-REQ id 40 len 17 from "Client"
00:12:32: Se0/0 PAP: Authenticating peer Client
00:12:32: Se0/0 PPP: Phase is FORWARDING, Attempting Forward
00:12:32: Se0/0 PPP: Phase is AUTHENTICATING, Unauthenticated User
00:12:32: Se0/0 PPP: Sent PAP LOGIN Request
00:12:32: Se0/0 PPP: Received LOGIN Response FAIL
00:12:32: Se0/0 PAP: O AUTH-NAK id 40 len 26 msg is "Authentication failed"
00:12:32: Se0/0 PPP: Sending Acct Event[Down] id[28]
00:12:32: Se0/0 PPP: Phase is TERMINATING
00:12:32: Se0/0 LCP: O TERMREQ [Open] id 134 len 4
00:12:33: Se0/0 LCP: I TERMACK [TERMsent] id 134 len 4
00:12:33: Se0/0 LCP: State is Closed
00:12:33: Se0/0 PPP: Phase is DOWN

Optional PPP Commands

The compress predictor interface subcommand enables the PPP Predictor compression algorithm; while the compress stac interface subcommand enables the PPP Stacker compression algorithm.

The ppp quality {percent} interface subcommand ensures a PPP link meets a percentage of quality during the optional link-quality determination phase in the PPP link establishment phase. This is to determine whether the link quality is sufficient to bring up any Layer 3 protocols. The link will not be established if it does not meet the percentage level.
Note: PPP link establishment is handled by Link Control Protocol (LCP).

The ppp authentication {pap | chap} {chap | pap} interface subcommand defines a PPP link to use the 1st authentication protocol, but will try 2nd authentication protocol if the 1st authentication protocol fails or rejected by the other side.

The ppp sent-username {username} password {password} interface subcommand is mandate in PAP configuration.

In PPP authentication configuration, passwords are case sensitive but usernames are not case-sensitive.