2000 Called side: 20:15:01: %LINK-3-UPDOWN: Interface BRI1/0:1, changed state to up 20:15:01: BR1/0:1 PPP: Using dialer call direction 20:15:01: BR1/0:1 PPP: Treating connection as a callin 20:15:02: BR1/0:1 CHAP: 0 CHALLENGE id 3 len 28 from "NewYork" 20:15:02: BR1/0:1 CHAP: I RESPONSE id 3 len 28 from "Chicago" 20:15:02: BR1/0:1 CHAP: 0 SUCCESS id 3 len 4 20:15:03: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI1/0:1, changed state to up 20:15:07: %ISDN-6-CONNECT: Interface BRI1/0:1 is now connected to 7801000 Chicago NewYork# Chapter 26: Authentication in Cisco Devices Two-way authentication. As with PAP, when you're configuring CHAP for two-way au- thentication, the difference is the removal of the callin keyword from the ppp authen tication chap command on the calling router: Calling side: Hostname Chicago username NewYork password 0 Secret2 interface BRI1/0 encapsulation ppp ppp authentication chap Called side: Hostname NewYork username Chicago password 0 Secret2 interface BRI1/0 encapsulation ppp ppp authentication chap Now, the output from debug ppp authentication is a bit more verbose, as authentica- tion happens in both directions. I've included only the output for the called side here, for the sake of brevity: 20:01:59: %LINK-3-UPDOWN: Interface BRI1/0:1, changed state to up 20:01:59: BR1/0:1 PPP: Using dialer call direction 20:01:59: BR1/0:1 PPP: Treating connection as a callin 20:02:00: %ISDN-6-LAYER2UP: Layer 2 for Interface BR1/0, TEI 66 changed to up 20:02:00: BR1/0:1 CHAP: 0 CHALLENGE id 2 len 28 from "NewYork" 20:02:00: BR1/0:1 CHAP: I CHALLENGE id 2 len 28 from "Chicago" 20:02:00: BR1/0:1 CHAP: Waiting for peer to authenticate first 20:02:00: BR1/0:1 CHAP: I RESPONSE id 2 len 28 from "Chicago" 20:02:00: BR1/0:1 CHAP: 0 SUCCESS id 2 len 4 20:02:00: BR1/0:1 CHAP: Processing saved Challenge, id 2 20:02:00: BR1/0:1 CHAP: 0 RESPONSE id 2 len 28 from "NewYork" 20:02:00: BR1/0:1 CHAP: I SUCCESS id 2 len 4 20:02:01: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI1/0:1, changed state to up 20:02