H3C MSR810, Command Reference Manual

Page: 29 / 389

17
You can configure multiple authentication modes.
In any PPP authentication mode, AAA determines whether a us er can pass the authentication
through a l ocal authentication database or an AAA server. For more information about AAA
authentication, see
Security Configuration Guide
.
If you configure the
ppp authentication-mode
command with the
domain
keyword specified, you
must perform the following tasks:
• Use the specified ISP domain to authenticate the peer.
• Use a PPP address pool associated with this ISP domain for address allocation (if necessary).
You can use the
display domain
command to display the domain configuration.
The system can obtain ISP domains through multiple ways during user authentication. The system
chooses one of the following ISP domains for authentication in descending priority order:
• ISP domain specified by the
domain isp-name
option. Use a PPP address pool associated with
this ISP domain for address allocation (if necessary). You can use the
display domain
command to display the domain configuration.
• ISP domain contained in the username. If the ISP domain does not exist on the local device, the
user's access request is denied.
• ISP domain specified by the
default enable isp-name
option.
• Default ISP domain in the system. You can use the
domain default
command to configure the
default ISP domain. If no default ISP domain is configured, the default ISP domain (
system
) is
used.
For authentication on a dialup interface, configure authentication on both the physical interface and
the dialer interface. When a physical interface receives a DDR call request, it first initiates PPP
negotiation and authenticates the dial-in user. Then it passes the call to the upper layer protocol.
Examples
# Configure Serial 2/1/0 to authenticate the peer by using PAP.
<Sysname> system-view
[Sysname] interface serial 2/1/0
[Sysname-Serial2/1/0] ppp authentication-mode pap
# Configure Serial 2/1/0 to authenticate the peer by using PAP, CHAP, and MS-CHAP.
<Sysname> system-view
[Sysname] interface serial 2/1/0
[Sysname-Serial2/1/0] ppp authentication-mode pap chap ms-chap
Related commands
domain default
(
Security Command Reference
)
local-user
(
Security Command Reference
)
ppp chap password
ppp chap user
ppp pap local-user
ppp chap password
Use
ppp chap password
to set the password for CHAP authentication on an interface.
Use
undo ppp chap password
to restore the default.
Syntax
ppp chap password
{
cipher
|
simple
}
string