PPP, or Point-to-Point Protocol, is a data link layer protocol for point-to-point type lines introduced by the IETF. It is not a proprietary protocol and can interconnect devices from different vendors. It supports multiple protocols, provides optional identity authentication services, can compress data in various ways, supports dynamic address negotiation, and supports multilink bundling.
1. PAP:
Password Authentication Protocol. PAP is a two-way handshake authentication protocol. During the initial link setup, the peer being authenticated first initiates an authentication request and sends the username and password to the authenticator for identity verification. The password is sent in plaintext, so security is relatively low. PAP supports both one-way and two-way authentication. See authentication flowcharts and one-way/two-way authentication diagrams for details.
2. CHAP:
Challenge Handshake Authentication Protocol. CHAP verifies the identity of the peer being authenticated through a three-way handshake, completed during the initial link establishment. To improve security, verification is performed periodically after the link is established. CHAP is more secure than PAP because it does not send plaintext over the link; instead, it sends an MD5-hashed random number sequence. CHAP supports both one-way and two-way authentication.
3. Configuration Process:
hostname R_A
interface Serial2/0
ip address 192.168.1.1 255.255.255.0
encapsulation ppp
ppp pap sent-username R_A password 0 123
clock rate 64000
R_A(config-if)#ip address 192.168.1.1 255.255.255.0
R_A(config-if)#no shutdown
%LINK-5-CHANGED: Interface Serial2/0， changed state to up
Router>en
Router#conf t
Enter configuration commands， one per line. End with CNTL/Z.
Router(config)#hostname R_B
R_B(config)#username R_A password 0 123
R_B(config)#interface s3/0
R_B(config-if)#encapsulation ppp
R_B(config-if)#ppp authentication pap
R_B(config-if)#ip address 192.168.1.2 255.255.255.0
R_B(config-if)#no shutdown
On Router R_A:
R_A#debug ppp authentication
PPP authentication debugging is on
Serial2/0 Using hostname from interface PAP
Serial2/0 Using password from interface PAP
Serial2/0 PAP: O AUTH-REQ id 17 len 15
Serial2/0 PAP: Phase is FORWARDING， Attempting Forward
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0， changed state to up
On Router R_B:
R_B#ping 192.168.1.1
Type escape sequence to abort.
Sending 5， 100-byte ICMP Echos to 192.168.1.1， timeout is 2 seconds:
Success rate is 100 percent (5/5)， round-trip min/avg/max = 2/4/6 ms
Finally, pay attention to the correspondence between username/password information and routers; the correspondence of information between the authenticator and the authenticated peer; authentication information is case-sensitive. If the configuration does not take effect after modification, try restarting the port.