3Com REMOTE ACCESS SYSTEM 1500, Management Manual

Page: 99 / 300

Before you Begin
97
CHAP Authentication
Instead of actually sending a clear text password over the link, CHAP
relies on a “shared secret,” a password that both sides of the connection
know, but never send. When a remote system requests CHAP
authentication, the authenticating host replies with a challenge packet.
The challenge packet contains important information, including the
following:
■
Username for the host
■
Challenge value
The challenged system needs the username for the host to look up the
correct “shared secret” password. The “challenge value” is a randomly
generated character string. The challenged system then concatenates the
challenge value with the shared secret and passes the new string through
a hashing algorithm. When the hashing algorithm has formed a response
based on this string, the challenged system replies with a packet
containing both the response value and a username.
The authenticating host looks up the correct password for the username
received and then performs the same calculations the client performed,
comparing the result to the response value received. If the results match,
the RAS 1500 allows the challenged system to pass through. However,
the authenticating host can issue additional CHAP challenges at any time
during the connection.
Both ends of the connection must be using the same hashing algorithm
for the connection to succeed. The RAS 1500 uses the MD5 or MD4
Microsoft (Windows 95) algorithm.
Before you Begin
Before you configure the RAS 1500 for LAN-to-LAN routing, follow all the
configuration steps in the RAS 1500 Getting Started Guide.
Required Information Obtain the following information:
■
IP addresses and network masks
■
Local RAS1500 Ethernet port
■
Remote device Ethernet port
■
WAN link ports between the two devices
■
Routing settings