I struggle to understand what relation RADIUS has with PAP and CHAP. Individually, I understand how CHAP and PAP work but I need clarification

enter image description here

Based on the image above, imagine I set up the switch using the Radius Server to authenticate users. Everything is working. I can SSH to the switch from my PC and use some credentials from Radius Server. Here is how I see the connection:

  1. The user SSH to the switch, only SSH is used (neither chap nor PAP )

  2. The switch contacts the Radius server using Radius messages (Access-Request) and PAP or CHAP. Am I right? And even if I use PAP, the password won't be in clear text but MD5-hashed with the shared secret between the switch and the radius server

  3. The server responds to the switch with a message (Access-Accept).

  4. The switch responds to the PC and accepts the connection (only using SSH)

Is my understanding correct?

1 Answer 1


When user connects to Network device (switch) over SSH port (Default: 22), this is what going to happen.

  1. Network device will check in the configuration, for SSH what is the authentication method. Typically it will either RADIUS/TACACS or Local.

  2. If the authentication is using remote method, it creates either RADIUS and TACACS packet.

  3. Network device verifies what is the configured authentication method for remote device, it can be either PAP or CHAP.

  4. If the method is PAP, network device adds the VSA user-password, by creating hash of the password with shared secret (configured on both RADIUS server and RADIUS client)

  5. If the method is CHAP, network device adds a VSA CHA-Password. The password is created using following algorithm mentioned in the RFC.


  1. If the password validation is successful, remote server will send access-accept and network device presents console to the user for device management.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .