ADTRAN AOS Version R10.1.0 Command Reference Manual page 2150

Command Reference Guide
First, the local router (requiring its peer to be authenticated) sends a challenge containing only its own
unencrypted user name to the peer. The peer then looks up the user name in the user name database
within the PPP interface and, if found, takes the corresponding password and its own host name and
sends a response back to the local router. This data is encrypted. The local router verifies that the user
name and password are in its own user name database within the PPP interface and, if so, sends a
success back to the peer.
The PPP user name and password database is separate and distinct from the global user
name password database. For PAP and CHAP, use the database under the PPP interface
configuration.
Several example scenarios are given below for clarity.
Configuring CHAP Example 1: Only the local router requires the peer to authenticate itself.
On the local router (host name Local):
Local(config-demand 1)#ppp authentication chap
Local(config-demand 1)#username Peer password same
On the peer (host name Peer):
Peer(config-demand 1)#ppp chap password same
The first line of this configuration sets the authentication mode to CHAP. This means the peer is required to
authenticate itself to the local router via CHAP. The second line is the user name and password expected
to be sent from the peer. The peer uses its hostname and ppp chap password commands to send the
proper authentication information.
Both ends must have identical passwords.
Configuring CHAP Example 2: Using the ppp chap hostname command as an alternate solution.
On the local router (host name Local):
Local(config-demand 1)#ppp authentication chap
Local(config-demand 1)#username farend password same
On the peer (host name Peer):
Peer(config-demand 1)#ppp chap hostname farend
Peer(config-demand 1)#ppp chap password same
60000CRG0-35E Copyright © 2012 ADTRAN, Inc.
Demand Interface Command Set
2150