encapsulation ppp ppp authentication chap callin Called side (NewYork): hostname NewYork username Chicago password 0 Secret2 interface BRI1/0 encapsulation ppp ppp authentication chap Now, let's look at the debug output for a successful call using these configurations. The call was initiated from the Chicago router. If you look carefully, you'll see that the New York router is receiving a challenge from NewYork. The challenge entries in the debug output refer to the username, not the hostname. This can add to the con- fusion, as the username must match the hostname of the other router. Here's the debug output for both sides: Calling side: 20:08:11: %LINK-3-UPDOWN: Interface BRI1/0:1, changed state to up 20:08:11: BR1/0:1 PPP: Using dialer call direction 20:08:11: BR1/0:1 PPP: Treating connection as a callout 20:08:11: BR1/0:1 CHAP: I CHALLENGE id 3 len 28 from "NewYork" 20:08:11: BR1/0:1 CHAP: 0 RESPONSE id 3 len 28 from "Chicago" 20:08:11: BR1/0:1 CHAP: I SUCCESS id 3 len 4 20:08:12: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI1/0:1, changed state to up 20:08:17: %ISDN-6-CONNECT: Interface BRI1/0:1 is now connected to 7802000 Chapter 24: Authentication in Cisco Devices Called side: 20:15:01: %LINK-3-UPDOWN: Interface BRI1/0:1, changed state to up 20:15:01: BR1/0:1 PPP: Using dialer call direction 20:15:01: BR1/0:1 PPP: Treating connection as a callin 20:15:02: BR1/0:1 CHAP: 0 CHALLENGE id 3 len 28 from "NewYork" 20:15:02: BR1/0:1 CHAP: I RESPONSE id 3 len 28 from "Chicago" 20:15:02: BR1/0:1 CHAP: 0 SUCCESS id 3 len 4 20:15:03: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI1/0:1, changed state to up 20:15:07: %ISDN-6-CONNECT: Interface BRI1/0:1 is now connected to 7801000 Chicago NewYork# Two-way authentication. As with PAP, when configuring CHAP for two-way authentica- tion, the difference is the removal of the callin keyword from the ppp authentication chap command on the calling router: Calling side: hostname Chicago username NewYork password 0 Secret2 interface BRI1/0 encapsulation ppp ppp authent