 two-router network. The Chicago router will call the New- York router. As with PAP, there are two ways to authenticate using CHAP: one-way and two-way. Calling Called BRI 1/0 BRI 1/0 Chicago NewYork Figure 24-1. CHAP-authenticated ISDN call CHAP can be a little harder to understand than PAP because of the way it operates. When Cisco routers authenticate using CHAP, by default, no username is needed on the calling router. Instead, the hostname of the router is used as the username. While people seem to grasp that concept easily enough, how passwords are handled is little more complicated. With PAP, one or more username/password pairs are configured on the called router. When the calling router attempts to authenticate, it must send a username and password that match a configured pair on the called router. With CHAP, each router must have a username/password pair configured, but the username must be the hostname of the other router, and the passwords must be the same on both routers. Both the hostnames and the passwords are case-sensitive. Basic (Non-AAA) Authentication careful when configuring passwords. A common mistake is to enter a space or control character after a password during configuration. It's hard to catch such an error because everything will look normal. If you believe everything is configured correctly, but it's just not working, try removing the lines with the passwords and retyping them (using cut and paste usually doesn't solve the problem). While this can happen any time passwords are being configured, I find it especially madden- ing when I'm using CHAP because I'm constantly second-guessing my configuration. One-way authentication. We'll begin with some examples of one-way authentication using CHAP. Notice that the username configured on each router matches the host- name of the other router. Notice also that the password is the same for both usernames. The password must be the same on both routers: Calling side (Chicago): hostname Chicago username NewYork password 0 Secret2 interface BRI1/0 