d. The results are usually quite specific and easy to understand. Here, the password being sent from the calling router is incorrect. The debug was run on the called router: 8w4d: BR1/0:1 PPP: Using dialer call direction 8w4d: BR1/0:1 PPP: Treating connection as a callin 8w4d: BR1/0:1 PAP: I AUTH-REQ id 4 len 18 from "Bob" 8w4d: BR1/0:1 PAP: Authenticating peer Bob 8w4d: BR1/0:1 PAP: 0 AUTH-NAK id 4 len 27 msg is "Authentication failure" Bad password defined for username Bob In the next example, two-way authentication has succeeded. Notice that additional requests have been made. First, the called router receives the authorization request (AUTH-REQ) from the calling router. The called router then sends an authorization acknowledgment (AUTH-ACK) and an AUTH-REQ of its own back to the calling router. The final line in bold shows the AUTH-ACK returned by the calling router, completing the two-way authentication. The I and O before the AUTH-ACK and AUTH-REQ entries indicate the direction of the message (either In or Out): 00:00:41: %LINK-3-UPDOWN: Interface BRI1/0:1, changed state to up 00:00:41: BR1/0:1 PPP: Using dialer call direction Chapter 24: Authentication in Cisco Devices 00:00:41: BR1/0:1 PPP: Treating connection as a callin 00:00:43: %ISDN-6-LAYER2UP: Layer 2 for Interface BR1/0, TEI 68 changed to up 00:00:45: BR1/0:1 AUTH: Started process 0 pid 62 00:00:45: BR1/0:1 PAP: I AUTH-REQ id 2 len 17 from "Bob" 00:00:45: BR1/0:1 PAP: Authenticating peer Bob 00:00:45: BR1/0:1 PAP: 0 AUTH-ACK id 2 len 5 00:00:45: BR1/0:1 PAP: 0 AUTH-REO id 1 len 17 from "Bob" 00:00:45: BR1/0:1 PAP: I AUTH-ACK id 1 len 5 00:00:46: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI1/0:1, changed state to up 00:00:47: %ISDN-6-CONNECT: Interface BRI1/0:1 is now connected to 7802000 Bob CHAP is more secure than PAP because it never sends passwords. Instead, it forms a hash value derived from the username and password, and sends that. The devices determine whether the hash values match in order to authenticate. Figure 24-1 shows a simple