One-way CHAP authentication configuration example
Network requirements
As shown in Figure 6, configure Router A to authenticate Router B by using CHAP.
Figure 6: Network diagram
Configuration procedure
(Method 1) The authenticator configured with a username authenticates the supplicant by using CHAP.
Configure Router A:
# Create a user account for Router B.
<RouterA> system-view [RouterA] local-user userb
# Set a password for the user account.
[RouterA-luser-userb] password simple hello
# Set the service type of the user account to PPP.
[RouterA-luser-userb] service-type ppp [RouterA-luser-userb] quit
# Enable PPP encapsulation on Serial 2/0.
[RouterA] interface serial 2/0 [RouterA-Serial2/0] link-protocol ppp
# Configure the username for Router A when Router A authenticates Router B.
[RouterA-Serial2/0] ppp chap user usera
# Set the authentication mode to CHAP.
[RouterA-Serial2/0] ppp authentication-mode chap domain system
# Assign an IP address to Serial 2/0.
[RouterA-Serial2/0] ip address 200.1.1.1 16 [RouterA-Serial2/0] quit
# Configure local authentication for the PPP users in the default ISP domain system.
[RouterA] domain system [RouterA-isp-system] authentication ppp local
Configure Router B:
# Create a user account for Router A on Router B.
<RouterB> system-view [RouterB] local-user usera
# Set a password for the user account.
[RouterB-luser-usera] password simple hello
# Set the service type of the user account to PPP.
[RouterB-luser-usera] service-type ppp [RouterB-luser-usera] quit
# Enable PPP encapsulation on Serial 2/0.
[RouterB] interface serial 2/0 [RouterB-Serial2/0] link-protocol ppp
# Configure the username for Router B when Router B is authenticated.
[RouterB-Serial2/0] ppp chap user userb
# Assign an IP address to Serial 2/0 of Router B.
[RouterB-Serial2/0] ip address 200.1.1.2 16
(Method 2) The authenticator with no username configured authenticates the supplicant by using CHAP.
Configure Router A:
# Create a user account for Router B.
<RouterA> system-view [RouterA] local-user userb
# Set a password for the user account.
[RouterA-luser-userb] password simple hello
# Set the service type of the user account to PPP.
[RouterA-luser-userb] service-type ppp [RouterA-luser-userb] quit
# Set the authentication mode to CHAP.
[RouterA] interface serial 2/0 [RouterA-Serial2/0] ppp authentication-mode chap domain system
# Assign an IP address to Serial 2/0.
[RouterA-Serial2/0] ip address 200.1.1.1 16 [RouterA-Serial2/0] quit
# Configure local authentication for the PPP users in the default ISP domain system.
[RouterA] domain system [RouterA-isp-system] authentication ppp local
Configure Router B:
# Configure the username of Router B when Router B is authenticated.
<RouterB> system-view [RouterB] interface serial 2/0 [RouterB-Serial2/0] ppp chap user userb
# Set the default CHAP password.
[RouterB-Serial2/0] ppp chap password simple hello
# Assign an IP address to Serial 2/0.
[RouterB-Serial2/0] ip address 200.1.1.2 16
Verify the configuration:
Use the display interface serial command to display information about Serial 2/0 of Router B. The physical layer status and link layer status of the interface are both up, and the states of LCP and IPCP are both Opened, indicating PPP negotiation is successful. Router A and Router B can ping each other.
[RouterB-Serial2/0] display interface serial 2/0 Serial2/0 current state: UP Line protocol current state: UP Description: Serial2/0 Interface The Maximum Transmit Unit is 1500, Hold timer is 10(sec) Internet Address is 200.1.1.2/16 Primary Link layer protocol is PPP LCP opened, IPCP opened Output queue : (Urgent queuing : Size/Length/Discards) 0/100/0 Output queue : (Protocol queuing : Size/Length/Discards) 0/500/0 Output queue : (FIFO queuing : Size/Length/Discards) 0/75/0 Interface is V35 206 packets input, 2496 bytes 206 packets output, 2492 bytes [RouterB-Serial2/0] ping 200.1.1.1 PING 200.1.1.1: 56 data bytes, press CTRL_C to break Reply from 200.1.1.1: bytes=56 Sequence=1 ttl=255 time=103 ms Reply from 200.1.1.1: bytes=56 Sequence=2 ttl=255 time=1 ms Reply from 200.1.1.1: bytes=56 Sequence=3 ttl=255 time=1 ms Reply from 200.1.1.1: bytes=56 Sequence=4 ttl=255 time=1 ms Reply from 200.1.1.1: bytes=56 Sequence=5 ttl=255 time=10 ms --- 200.1.1.1 ping statistics --- 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/23/103 ms