Operation Manual – User Access
H3C SecPath Series Security Products
Chapter 1 PPP Configuration
1-1
Chapter 1 PPP Configuration
1.1 Introduction to PPP
1.1.1 Introduction to PPP
The Point-to-Point Protocol (PPP) is one of link layer protocols that bearing network
layer packets over point-to-point link. It has found wide application since it can provide
user authentication, support synchronous/asynchronous communication and, can be
expanded easily.
PPP defines a whole set of protocols, including Link Control Protocol (LCP), Network
Control Protocol (NCP) and authentication protocols Password Authentication Protocol
(PAP) and CHAP (Challenge Handshake Authentication Protocol). Where,
z
LCP is responsible for establishing, removing and monitoring data links.
z
NCP is used to negotiate the format and type of the packets over data links.
z
Authentication protocol suite used for network security
1) PAP
authentication
PAP is a 2-way handshake authentication protocol and it sends the password in plain
text. The process of PAP authentication is as follows:
z
The requester sends its username and password to the authenticating party.
z
The authenticator will check if the username and password are correct according
to local user list and then return different responses (Acknowledge or Not
Acknowledge).
2) CHAP
authentication
CHAP (Challenge-Handshake Authentication Protocol) is a 3-way handshake
authentication protocol and the password is sent encrypted. The process of CHAP
authentication is as follows:
z
The authenticator actively initiates an authentication request by sending some
randomly generated packets (Challenge) to the authenticatee, carrying its own
username in the packets.
z
When the authenticatee receives the authentication request initiated by the
authenticator, it looks up the user passwords in the local user database for a
match with the authenticator’s username in the received packet. If it finds a match,
the authenticatee will use the MD5 algorithm to encrypt this random packet with
packet ID and user’s key (password) and then send the generated ciphertext and
its own username back to the authenticator (Response); if the authenticator does
not find any match, it checks whether the
ppp chap password
command is
configured on its interface. If this command is configured, the authenticatee will
use the MD5 algorithm to encrypt this random packet with packet ID and user’s
