Does Https Cross State Lines To The Internet Service Providerã¢â‚¬â€¹ (Isp) Base

Introduction

The Challenge Handshake Hallmark Protocol (CHAP) (defined in RFC 1994 ) verifies the identity of the peer by ways of a three-way handshake. These are the full general steps performed in CHAP:

After the LCP (Link Control Protocol) stage is consummate, and CHAP is negotiated betwixt both devices, the authenticator sends a claiming message to the peer.
The peer responds with a value calculated through a one-style hash part (Message Assimilate v (MD5)).
The authenticator checks the response against its ain calculation of the expected hash value. If the values match, the authentication is successful. Otherwise, the connection is terminated.

This authentication method depends on a "secret" known only to the authenticator and the peer. The secret is non sent over the link. Although the authentication is only one-fashion, y'all can negotiate CHAP in both directions, with the help of the same hush-hush set for mutual authentication.

For more than data on the advantages and disadvantages of CHAP, refer to RFC 1994 .

Prerequisites

Requirements

Readers of this document should have noesis of these topics:

How to enable PPP on the interface through the encapsulation ppp command.
The debug ppp negotiation command output. Refer to Understanding debug ppp negotiation Output for more information.
Ability to troubleshoot when the Link Control Protocol (LCP) phase is not in the open up state. This is considering, the PPP authentication phase does not begin until the LCP phase is consummate and is in the open up country. If the debug ppp negotiation command does non indicate that LCP is open, you need to troubleshoot this issue before y'all keep.

Note:This certificate does not address MS-CHAP (Version 1 or Version ii). For more information on MS-CHAP, refer to the MS-CHAP Back up and MSCHAP Version two documents.

Components Used

This certificate is non restricted to specific software and hardware versions.

Conventions

For more information on certificate conventions, see the Cisco Technical Tips Conventions.

Configure CHAP

The procedure to configure CHAP is fairly straightforward. For case, presume that you take two routers, left and right, connected across a network, as shown in effigy 1.

Figure ane â€" Two Routers Connected Beyond a Network

To configure CHAP authentication, consummate these steps:

On the interface, issue the encapsulation ppp control.
Enable the use of CHAP hallmark on both routers with the ppp hallmark chap command.
Configure the usernames and passwords. To do and so, issue the username username password countersign command, where username is the hostname of the peer. Ensure that:
- Passwords are identical at both ends.
- The router name and password are exactly the same, considering they are case-sensitive.
Note:By default, the router uses its hostname to identify itself to the peer. However, this CHAP username can be changed through the ppp chap hostname command. Refer to PPP Authentication Using the ppp chap hostname and ppp hallmark chap callin Commands for more information.

One-Fashion and Two-Way Authentication

CHAP is defined equally a ane-manner authentication method. Even so, you use CHAP in both directions to create a two-way authentication. Hence, with two-mode CHAP, a divide three-manner handshake is initiated past each side.

In the Cisco CHAP implementation, by default, the called party must cosign the calling party (unless authentication is completely turned off). Therefore, a one-way hallmark initiated by the chosen political party is the minimum possible hallmark. All the same, the calling political party can also verify the identity of the called party, and this results in a ii-manner authentication.

I-mode authentication is often required when you connect to not-Cisco devices.

For one-way hallmark, configure the ppp authentication chap callin command on the calling router.

Tabular array ane shows when to configure the callin option.

Tabular array one â€" When to Configure the Callin Option

Authentication Type	Client (calling)	NAS (chosen)
1-way (unidirectional)	ppp authentication chap callin	ppp authentication chap
Two-way (bidirectional)	ppp authentication chap	ppp authentication chap

For more data on how to implement i-way authentication, refer to PPP Authentication Using the ppp chap hostname and ppp authentication chap callin Commands.

CHAP Configuration Commands and Options

Table 2 lists the CHAP commands and options:

Table 2 â€" CHAP Commands and Options

Control	Clarification
ppp authentication {chap \| ms-chap \| ms-chap-v2 \| eap \|pap} [callin]	This control enables local authentication of the remote PPP peer with the specified protocol.
ppp chap hostname username	This control defines an interface-specific CHAP hostname. Refer to PPP Authentication Using the ppp chap hostname and ppp hallmark chap callin Commands for more than information.
ppp chap password password	This command defines an interface-specific CHAP password.
ppp management callin \| callout \| dedicated	This control forces a telephone call direction. Apply this command when a router is confused as to whether the call is incoming or outgoing (for case, when connected back-to-back or connected by leased lines and the Channel Service Unit or Data Service Unit (CSU/DSU) or ISDN Concluding Adapter (TA) are configured to dial).
ppp chap refuse [callin]	This control disables remote authentication by a peer (default enabled). With this command, CHAP authentication is disabled for all calls, which means that all attempts by the peer to force the user to authenticate with the aid of CHAP are refused. The callin choice specifies that the router refuses to answer CHAP hallmark challenges received from the peer, but all the same requires the peer to answer any CHAP challenges that the router sends.
ppp chap wait	This command specifies that the caller must authenticate offset (default enabled). This command specifies that the router volition not authenticate to a peer that requests CHAP authentication until after the peer has authenticated itself to the router.
ppp max-bad-auth value	This command specifies the allowed number of authentication retries (the default value is 0). This command configures a bespeak-to-point interface not to reset itself immediately after an authentication failure, just instead to allow a specified number of authentication retries.
ppp chap splitnames	This subconscious command allows different hostnames for a CHAP challenge and response (the default value is disabled).
ppp chap ignoreus	This hidden command ignores CHAP challenges with the local name (the default value is enabled).

Transactional Case

The diagrams in this department show the serial of events that occur during a CHAP authentication betwixt ii routers. These do not represent the bodily messages seen in the debug ppp negotiation control output. For more than information, refer to Understanding debug ppp negotiation Output.

Call

Figure 2 â€" The Call Comes In

Figure 2 shows these steps:

The call comes in to 3640-i. The incoming interface is configured with the ppp authentication chap command.
LCP negotiates CHAP and MD5. For more than information on how to determine this, refer to Understanding the debug ppp negotiation Output.
A CHAP challenge from 3640-one to the calling router is required on this telephone call.

Challenge

Effigy iii â€" A CHAP Challenge Packet is Built

Figure 3 illustrates these steps in the CHAP authentication between the two routers:

A CHAP claiming packet is built with these characteristics:
- 01 = claiming package type identifier.
- ID = sequential number that identifies the challenge.
- random = a reasonably random number generated past the router.
- 3640-1 = the authentication name of the challenger.
The ID and random values are kept on the called router.
The challenge package is sent to the calling router. A list of outstanding challenges is maintained.

Response

Figure 4 â€" Receipt and MD5 Processing of the Challenge Packet from the Peer

Figure 4 illustrates the how the challenge packet is received from the peer, and processed (MD5). The router processes the incoming CHAP challenge packet in this style:

The ID value is fed into the MD5 hash generator.
The random value is fed into the MD5 hash generator.
The proper name 3640-1 is used to wait up the password. The router looks for an entry that matches the username in the challenge. In this example, it looks for:
```
username 3640-1 password pc1
```
The password is fed into the MD5 hash generator.

The result is the i-way MD5-hashed CHAP challenge that is sent dorsum in the CHAP response.

Response (continued)

Effigy 5 â€" The CHAP Response Packet Sent to the Authenticator is Congenital.

Figure 5 illustrates how the CHAP response package sent to the authenticator is built. This diagram shows these steps:

The response packet is assembled from these components:
- 02 = CHAP response packet type identifier.
- ID = copied from the challenge packet.
- hash = the output from the MD5 hash generator (the hashed information from the challenge packet).
- 766-one = the authentication name of this device. This is needed for the peer to expect upwards the username and password entry needed to verify identity (this is explained in more than particular in the Verify CHAP section).
The response packet is and so sent to the challenger.

Verify CHAP

This section provides tips on how to verify your configuration.

Figure 6 â€" The Challenger Processes the Response Package

Figure 6 shows how the challenger processes the response packet. Here are the steps involved when the CHAP response packet is processed (on the authenticator):

The ID is used to find the original challenge packet.
The ID is fed into the MD5 hash generator.
The original claiming random value is fed into the MD5 hash generator.
The name 766-1 is used to look up the password from one of these sources:
- Local username and password database.
- RADIUS or TACACS+ server.
The password is fed into the MD5 hash generator.
The hash value received in the response parcel is then compared with the calculated MD5 hash value. CHAP authentication succeeds if the calculated and the received hash values are equal.

Outcome

Figure seven â€" Success Bulletin is Sent to the Calling Router

Figure 7 illustrates the success message sent to the calling router. It involves these steps:

If authentication is successful, a CHAP success packet is congenital from these components:
- 03 = CHAP success message blazon.
- ID = copied from the response packet.
- â€œWelcome inâ€ is only a text message that provides a user-readable explanation.
If authentication fails, a CHAP failure packet is built from these components:
- 04 = CHAP failure message blazon.
- ID = copied from the response parcel.
- â€œAuthentication failureâ€ or other text message, that provides a user-readable explanation.
The success or failure packet is and then sent to the calling router.

Note:This example depicts a ane-fashion hallmark. In a 2-way authentication, this unabridged process is repeated. Nonetheless the calling router initiates the initial challenge.

Troubleshoot CHAP

Refer to Troubleshooting PPP Authentication for information on how to troubleshoot issues.

Related Information

Understanding debug ppp negotiation Output
Troubleshooting PPP Authentication
PPP Authentication Using the ppp chap hostname and ppp authentication chap callin Commands
Access Technology Support Pages
Technical Support - Cisco Systems