f a PPP authentication scheme is required, you must decide which scheme is right for you. Usually, CHAP is the right choice, due to its increased security, though PAP can Chapter 26: Authentication in Cisco Devices be used when minimal security is desired or the possibility of capturing packets is at a minimum. To use either method, you must have a local user configured at least on the receiving (called) router, although, as you'll see, the requirements vary. Configuring non-AAA authentication for PPP is covered here. To read about AAA PPP authentication using PAP and CHAP, see "Applying Method Lists" on page 456. PAP can be configured for one-way or two-way authentication. One-way authentica- tion indicates that only one side initiates a challenge. Two-way authentication indicates that both sides of the link authenticate each other. One-way authentication. With one-way authentication, the calling router sends a username and password, which must match a username and password configured on the called router. The calling router must be configured as a callin router with the ppp authen tication pap callin command. The calling router must also be configured to send a username and password with the ppp pap sent-username command. Here are some example configurations. Configuration entries not specific to PPP authentication are not shown, for clarity: Calling side: interface BRI1/0 encapsulation ppp ppp authentication pap callin ppp pap sent-username Bob password 0 ILikePie Called side: username Bob password 0 ILikePie interface BRI1/0 encapsulation ppp ppp authentication pap I thought about removing the ISDN references in this chapter. If you live in a major metropolitan area, chances are all of your ISDN has been replaced with broadband. The Cisco CCIE exam even removed it from the lab some time ago. Rest assured, though, that even in 2010, there are areas of the country that still do not have broadband available. I've worked on nationwide MPLS rollouts recently and we had to keep the aging ISDN head end infrastructur