There are simply two methods to authenticate PPP links namely Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP).
From these two authentication protocols, PAP is less secured as the password is sent in clear text and is performed only at the initial link establishment.
PAP is a password Authentication Protocol used by PPP links to validate users. PAP authentication requires the calling device to enter the username and password. If the credentials match with the local database of the called device or in the remote AAA database then it is allowed to access otherwise denied.
The password is sent in clear text.
All network operating system support PAP.
It uses two-way Handshake Protocol.
PAP supports both one-way authentication (unidirectional) and two-way authentication (bidirectional).
There is a small topology in which there are 2 routers namely R1 and R2. R1 having ip address 10.1.1.1/30 on s0/0 and R2 have ip address 10.1.1.2/30 on s0/0.
Remember, by default HDLC is configured on Cisco routers therefore first we have to change the encapsulation to PPP and enable PAP.
Here, notice that username and password are case-sensitive. Also, on router R1 we have to give a username and password.
This command can also be used on the router which wants to authenticate (calling router) in case of one-way authentication i.e only calling router will authenticate.
If two-way authentication, i.e both client and remote device are going to authenticate to each other, is operating then we have to make a local database and use this command on both devices.
In addition if we want to use CHAP first and PAP as backup when CHAP fails, we can configure it by the command.
Also, if we want as CHAP as backup then use the command.
When the application doesn’t support CHAP.
Circumstances where it is necessary to sent a plain text password to stimulate a login at the called device (remote host).
When there is occurrence of incompatibilities between different vendors of CHAP.
CHAP is more secured than PAP.
CHAP can provide authentication periodically to recognise that the user accessing the PPP link is same or not.
In CHAP, the real passwords are never shared on the link instead a hash value of it is calculated and transferred.
The only advantage PAP holds over CHAP is that it is supported by the all the network operating system vendors therefore it can be said that PAP is used where CHAP is not supported. But if CHAP is supported then it is recommended to use CHAP as it is more secured.