>From the Cisco Security Configuration Guide: "When CHAP is enabled on an interface and a remote device attempts to connect to it, the access server sends a CHAP packet to the remote device. The CHAP packet requests or "challenges" the remote device to respond. The challenge packet consists of an ID, a random number, and the host name of the local router.
When the remote device receives the challenge packet, it concatenates the ID, the remote device's password, and the random number, and then encrypts all of it using the remote device's password. The remote device sends the results back to the access server, along with the name associated with the password used in the encryption process. When the access server receives the response, it uses the name it received to retrieve a password stored in its user database. The retrieved password should be the same password the remote device used in its encryption process. The access server then encrypts the concatenated information with the newly retrieved password-if the result matches the result sent in the response packet, authentication succeeds." Both routers authenticate each other; it's not just a one-way authentication. So, Router2 would send its name, ID, and random number to Router 3. Router3 NEEDS a "username Router2" entry so that it can encrypt the response. It uses the password to encrypt, and then sends the response back to Router2. Router2 then NEEDS a "username Router2" to check to make sure that Router3 had the right password. Then, Router3 sends its ID, random number, and hostname to Router2. Router2 NEEDS a "username Router3" entry to encrypt the packet and send it back to Router3. Router3 then NEEDS a "username Router3" to check to make sure that Router2 used the correct password to encrypt the data. I don't see how you can get away with only providing one username on each router. Fred Reimer - CCNA Eclipsys Corporation, 200 Ashford Center North, Atlanta, GA 30338 Phone: 404-847-5177 Cell: 770-490-3071 Pager: 888-260-2050 NOTICE; This email contains confidential or proprietary information which may be legally privileged. It is intended only for the named recipient(s). If an addressing or transmission error has misdirected the email, please notify the author by replying to this message. If you are not the named recipient, you are not authorized to use, disclose, distribute, copy, print or rely on this email, and should immediately delete it from your computer. -----Original Message----- From: Kenneth [mailto:[EMAIL PROTECTED] Sent: Tuesday, September 02, 2003 12:10 PM To: [EMAIL PROTECTED] Subject: PPP authentication [7:74551] Hiyah everyone, I have two routers, Router2 and Router3, one a 2500 and the other a 2600. Configuring CHAP on the link, I just need (supposedly) to include these lines on the global config Router2(config)# username Router3 password abc Router3(config)# username Router2 password abc And apply "ppp auth chap" to the interfaces. However, when doing this, the link becomes more of a flapping link, and, running "debug ppp auth", there is no authentication success. However, if I were to do this: Router2(config)# username Router3 password abc Router2(config)# username Router2 password abc Router3(config)# username Router2 password abc Router3(config)# username Router3 password abc and apply CHAP on the respective interfaces, the link just comes up! >From the various sources that I checked, the former implementation would've worked, but in my case, the latter works, not the former. I'm wondering whether this is due to IOS version issues or not. I'm not in the office now, so I can't check the versions atm. Any comments on this matter would be appreciated. Thanks. Kenneth **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=74671&t=74551 -------------------------------------------------- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
