PPP Authentication: PAP and CHAP

PPP Authentication: PAP and CHAP

Quick Answer: After LCP agrees that authentication is required, PPP can run PAP or CHAP. PAP is a two-way exchange that sends the password in plaintext. CHAP is a three-way challenge-response method that does not put the password on the wire and is the more secure default choice on exams. On Huawei VRP, set ppp authentication-mode on the interface and supply matching local or AAA credentials.

Authentication is the middle act of the PPP play. If you skip it in design when the ISP requires it, the session never reaches NCP. If you pick the wrong method or mismatched secrets, LCP may look fine while the link still fails to pass IP. HCIA-Datacom tests the mechanics, security comparison, and configuration intent more than exotic multiprotocol edge cases.

Where authentication sits in the PPP lifecycle

1. Physical / lower-layer media is available (serial up, PPPoE session progressing, and so on).
2. LCP opens, negotiates options, and—if configured—includes the authentication protocol option.
3. Authentication runs to completion (success or failure).
4. On success, NCP (for IPv4, IPCP) negotiates network parameters and IP can flow.

Either peer can require the other to authenticate, depending on design (ISP authenticates the customer; enterprise may authenticate a remote peer). For branch Internet, the common pattern is: ISP authenticates the customer CPE with a username and password provisioned on the account.

PAP: Password Authentication Protocol

PAP is intentionally simple.

Two-way exchange (conceptual)

That is why PAP is called a two-way handshake: credentials go out, result comes back. There is no cryptographic challenge.

Strengths and weaknesses

Exam wording: If the question says the password is transmitted in cleartext, or asks which method is less secure, the answer is PAP.

CHAP: Challenge Handshake Authentication Protocol

CHAP improves security by never sending the shared secret as plaintext password bytes in the authentication messages.

Three-way challenge-response (conceptual)

Because the challenge is unpredictable, a captured response is not reusable as a static password later in the same way a sniffed PAP password is. CHAP can also re-challenge during a live session so a compromised session start is harder to ride indefinitely—exam materials often mention periodic re-authentication as a CHAP advantage.

Strengths and weaknesses

| Aspect | CHAP behavior | |---|---|---| | Password on the wire | No (hash response) | | Handshake shape | Three-way | | Security relative to PAP | Stronger for HCIA comparison questions | | Shared secret requirement | Both sides need the matching secret/password material | | Complexity | Higher than PAP |

Exam wording: “challenge-response,” “three-way,” “more secure,” or “password not sent in plaintext” → CHAP.

Side-by-side comparison table

Do not invent a third “better than CHAP” PPP password method on HCIA unless the stem explicitly introduces another technology. The tested pair is PAP vs CHAP.

Huawei VRP configuration concepts (HCIA level)

Exact syntax can vary slightly by platform and software train, but the conceptual knobs are stable:

1) Choose authentication mode on the PPP interface

Under the interface that runs PPP (serial example conceptually):

[Huawei] interface Serial0/0/0
[Huawei-Serial0/0/0] link-protocol ppp
[Huawei-Serial0/0/0] ppp authentication-mode chap

Or for PAP:

[Huawei-Serial0/0/0] ppp authentication-mode pap

Some designs use chap pap style fallback ordering when both are offered; know that mode selection must match what the peer demands. If the ISP requires CHAP only, configuring PAP alone will not pass authentication.

2) Provide the local user or AAA credentials

The authenticator needs a username/password database entry that matches what the peer sends (PAP) or uses as the CHAP secret material. On associate-level labs this is often a local user:

[Huawei] aaa
[Huawei-aaa] local-user branch01 password irreversible-cipher StrongP@ssw0rd
[Huawei-aaa] local-user branch01 service-type ppp

(Service-type and password form can differ by version; the exam idea is: user exists, password matches, PPP service allowed.)

When the Huawei device is the client authenticating to an ISP, you configure the call-out credentials on the interface or dialer (username/password for PAP/CHAP client role). In PPPoE edge designs (next section), those credentials ride the dialer/PPP client.

3) Authentication direction roles

Misreading the role causes “I set a local user but I am the client to the ISP” confusion. For ISP Internet access, the ISP is usually the authenticator; your router supplies the account the ISP already created.

Verification and failure patterns

Useful mental checks (command families, not a full CLI encyclopedia):

[Huawei] display interface Serial0/0/0
[Huawei] display ppp interface Serial0/0/0

Interpret symptoms against the phase model:

Exam trap: A wrong password is an authentication failure, not proof that OSPF is broken on the LAN. Fix the secret and mode before redesigning the campus.

Security guidance for the exam (and real life)

• Prefer CHAP when the question allows either and highlights security.
• Treat PAP as legacy or explicitly required only.
• Remember that CHAP still depends on secret strength and protection of the device config—hashing the password on the wire does not help if display current-configuration is world-readable without AAA control.
• PPPoE does not replace PAP/CHAP; it carries PPP, so the same auth choice still matters.

Common H12-811 traps

Practice goals before PPPoE

1. Draw PAP’s two messages and CHAP’s three messages from memory.
2. Given a stem that says “password not transmitted,” select CHAP without hesitation.
3. On a mental Huawei serial PPP interface, state where ppp authentication-mode is set and why a local user needs PPP service permission when acting as authenticator.
4. Map “auth failed” vs “no IP address” to different PPP phases.

With PAP and CHAP clear, the next section places the same PPP session on top of Ethernet broadband using PPPoE, including discovery stages and Huawei dialer/client ideas.