I'm learning to configure a simple PPP link with CHAP authentication for two Cisco routers. I'm trying to make sense of how router makes sense of the configuration in this example, as the logic of the configuration seems ambiguous to me.

In the configuration the username and password for the neighbor router is in the global configuration, which seems to make sense, as when a neighbor router authenticates, its name and password can be checked against the global user/password section.

There is however nothing in the configuration that explicitly tells a router what password to answer with when challenged by a neighboring router. For example (please refer to the diagram), if R1 received a challenge from R2, how does R1 know to answer with "mypass" as the CHAP password? Does R1 know that the CHAP challenge was sent from R2, and therefore it should use that password that is in the R2 user/password global pair?

Also if the user/password for CHAP are all set up in the global config and use the logic I just imagined, do multiple routers that are set up in a system all have to use the same CHAP password? Or is there a way to specify the CHAP password to use for a specific interface, or to a specific neighboring router?

enter image description here

  • Sounds like a question for Cisco support or product specific forum – Neil Smithline Jun 1 '16 at 0:45
  • I tried to answer but this Question seems too broad, you are better off reading the RFC 1994 first. – JOW Jun 1 '16 at 13:55

When you configure an interface to use CHAP, you must assign an access profile to the interface. When an interface receives CHAP challenges and responses, the access profile in the packet is used to look up the shared secret, as defined in RFC 1994.

If no matching access profile is found for the CHAP challenge that was received by the interface, the optionally configured default CHAP secret is used. The default CHAP secret is useful if the CHAP name of the peer is unknown, or if the CHAP name changes during PPP link negotiation.

more information on

  1. configuring the Shared Secret in Cisco IOS
  2. Access profile

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.