e: GAD Password: Interface IP-Address OK? Method Status Protocol FastEtherneto/o 10.100.100.1 YES NVRAM up FastEthernet0/1 unassigned YES NVRAM administratively down down Serial0/0/0:0 unassigned YES unset down This may not seem like a useful feature until you consider the possibility that a first- line engineer may need to execute only one command. Why give him access to anything else? Another possibility with the autocommand feature is to call a predefined menu of commands (configuring menus is outside the scope of this book): R1 (config)# username GAD autocommand menu root-menu If you specify a command or menu that does not exist, the user will not be able to log in even with proper authentication. You can disable the automatic disconnection after autocommand with the nohangup keyword: R1 (config)# username GAD nohangup autocommand menu root-menu Chapter 24: Authentication in Cisco Devices PPP Authentication Authenticating a PPP connection is possible through one of two methods: Password Authentication Protocol (PAP), and Challenge Handshake Authentication Protocol (CHAP). PAP is the easier of the two to implement and understand, but it is of lim- ited value because it transmits passwords in clear text. CHAP uses a more secure algorithm that does not include sending passwords. Both methods are outlined in RFC 1334. The RFC includes this warning about PAP: PAP is not a strong authentication method. Passwords are sent over the circuit "in the clear", and there is no protection from playback or repeated trial and error attacks. The peer is in control of the frequency and timing of the attempts. Any implementations which include a stronger authentication method (such as CHAP, described below) MUST offer to negotiate that method prior to PAP. If a PPP authentication scheme is required, you must decide which scheme is right for you. Usually, CHAP is the right choice, due to its increased security, though PAP can be used when minimal security is desired, or the possibility of capturing packets is at a minimum. To use