Bay Networks 5390, Administering, Page: 469 / 888

893-741-B A15-49
Using Model 5390 Security
Sending a CHAP Challenge
When the Model 5390 server sends a challenge, it includes the chap_auth_name parameter value
as the name field and a randomly generated number as the value field. If ACP is used, after receiving
a response, the Model 5390 server acquires the secret token based on the name in the response
message (the Model 5390 server uses the port_password parameter value as the secret token if
local security is used). If the result of running MD5 encryption on the secret token and the randomly
generated number produce the same value as in the Response value field, the Model 5390 server
sends a success message and the link enters NCP negotiation; otherwise, the Model 5390 server
sends a failure message and terminates the link.
The Model 5390 server sends a challenge only if the enable_security parameter is set to Y, the
ppp_security_protocol parameter is set to chap, and CHAP is ACKed during LCP. If the Model
5390 server is ACKed for CHAP, it will seek only one valid response. After the Model 5390 server
receives a valid response, it sends challenges at irregular intervals while the link is up.
ACP logging for CHAP includes good responses received, bad responses received, and peer refusal
to do CHAP (for more details on security logging, as well as a sample log file, see Host-based
Security Logging on page B1-22).
Using the PPP Security Parameters
There are a variety of settings one can choose when configuring the
Model 5390 server for PPP security. Table A15-11 lists the possible combinations of PPP security
NOTE:
The Model 5390 server terminates a link if it cannot authenti-
cate a challenge. If the Model 5390 server does not receive a response
to a challenge within the allotted time-out, it reissues the challenge for
the defined number of retries.