 00:00:41: BR1/0:1 PPP: Treating connection as a callin 00:00:43: %ISDN-6-LAYER2UP: Layer 2 for Interface BR1/0, TEI 68 changed to up 00:00:45: BR1/0:1 AUTH: Started process 0 pid 62 00:00:45: BR1/0:1 PAP: I AUTH-REQ id 2 len 17 from "Bob" 00:00:45: BR1/0:1 PAP: Authenticating peer Bob 00:00:45: BR1/0:1 PAP: 0 AUTH-ACK id 2 len 5 00:00:45: BR1/0:1 PAP: 0 AUTH-REQ id 1 len 17 from "Bob" 00:00:45: BR1/0:1 PAP: I AUTH-ACK id 1 len 5 00:00:46: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI1/0:1, changed state to up 00:00:47: %ISDN-6-CONNECT: Interface BRI1/0:1 is now connected to 7802000 Bob Chapter 26: Authentication in Cisco Devices CHAP is more secure than PAP because it never sends passwords. Instead, it forms a hash value derived from the username and password, and sends that. The devices de- termine whether the hash values match in order to authenticate. Figure 26-1 shows a simple two-router network. The Chicago router will call the New- York router. As with PAP, there are two ways to authenticate using CHAP: one-way and two-way. Calling Called BRI 1/0 BRI 1/0 Chicago NewYork Figure 26-1. CHAP-authenticated ISDN call CHAP can be a little harder to understand than PAP because of the way it operates. When Cisco routers authenticate using CHAP, by default, no username is needed on the calling router. Instead, the hostname of the router is used as the username. While people seem to grasp that concept easily enough, how passwords are handled is a little more complicated. With PAP, one or more username/password pairs are configured on the called router. When the calling router attempts to authenticate, it must send a username and pass- word that match a configured pair on the called router. With CHAP, each router must have a username/password pair configured, but the username must be the hostname of the other router, and the passwords must be the same on both routers. Both the hostnames and the passwords are case-sensitive. Be careful when configuring passwords. A common mistake is to enter a space or control ch