Cabletron Systems CSX100 series User Manual - Pap And Chap Security

ISDN Router

92

Point-To-Point Protocol (PPP)

PPP is a data link layer industry standard WAN protocol for transferring

multi-protocol data traffic over point-to-point connections.  It is suitable for

both high-speed synchronous ports as well as lower speed asynchronous dial-

up ports.  With this protocol, options such as security and network protocols

can be negotiated over the connection.

The Router supports synchronous PPP over the ISDN port.

In Single Link Mode, PPP utilizes one ISDN B-channel for data

transmission.  PPP can be run over each ISDN B-channel for two separate

conversations (split B-channel).

In Multi-Link Protocol Mode (MLP), PPP can simultaneously send and

receive data over two ISDN B-channels on the same connection to optimize

bandwidth usage.

The STAC® Electronics Stacker LZS™ Compression Protocol is supported

over PPP providing up to 4:1 data compression.

The Ascend and Microsoft variants are also supported.

PAP and CHAP Security

The router supports the Password Authentication Protocol (PAP) and

Challenge Handshake Authentication Protocol (CHAP) under PPP.

PAP provides verification of passwords between routers using a 2-way

handshake:

One router (peer) sends the system name and password to the other router.

Then the other router (known as the authenticator) checks the peer’s

password against the configured remote router’s password and returns

acknowledgment.

CHAP is more secure than PAP as unencrypted passwords are not sent across

the network.  CHAP uses a 3-way handshake:

One router (known as the authenticator) challenges the other router (known

as the peer) by generating a random number and sending it along with its

system name.  The peer then applies a one-way hash algorithm to the random

number and returns this encrypted information along with its own system

name.  The authenticator then runs the same algorithm and compares the

result with the expected value.  This authentication method depends upon a

password or secret, known only to both ends.