237
Step Command
Remarks
3.
Configure a username for
the CHAP peer.
ppp chap user
username
The default setting is null.
The username you configure on the
peer must be the same as the local
username you configure for the peer
on the authenticator.
4.
Set the CHAP
authentication password.
ppp chap password
{
cipher
|
simple
}
string
The default setting is null.
The password you set on the peer
must be the same as the password
you set for the peer on the
authenticator.
For security purposes, the password
specified in plaintext form and
ciphertext form will be stored in
encrypted form.
Configuring MS-CHAP or MS-CHAP-V2 authentication
When you configure MS-CHAP or MS-CHAP-V2 authentication, follow these guidelines:
•
The device can only act as an authenticator for MS-CHAP or MS-CHAP-V2 authentication.
•
L2TP supports only MS-CHAP authentication.
•
MS-CHAP-V2 authentication supports password change only when using RADIUS.
•
As a best practice, do not set the authentication method for PPP users to
none
when
MS-CHAP-V2 authentication is used.
Configuring MS-CHAP or MS-CHAP-V2 authentication (authenticator name is configured)
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface
interface-type
interface-number
N/A
3.
Configure the authenticator
to authenticate the peer by
using MS-CHAP or
MS-CHAP-V2.
ppp authentication-mode
{
ms-chap
|
ms-chap-v2
}
[
domain
{
isp-name
|
default
enable isp-name
} ]
By default, PPP authentication is
disabled.
4.
Configure a username for the
MS-CHAP or MS-CHAP-V2
authenticator.
ppp chap user
username
The username for the
authenticator must be the same
on the local and peer devices.
5.
Configure local or remote
AAA authentication.
For local AAA authentication, the
username and password of the
peer must be configured on the
authenticator.
For remote AAA authentication,
the username and password of
the peer must be configured on
the remote AAA server.
For more information about AAA
authentication, see "
The username and password of
the peer configured on the
authenticator or remote AAA
server must be the same as those
configured on the peer.
