PPP Video on Demand (IPExpert CCIE R&S BLS)

Today I was watching the PPP Video-on-Demand from IPExpert´s CCIE R&S Blended Learning Solutions, and learned some new tricks! AWESOME!

PPP is fair simple, configuring it is not that difficult, BUT, as always, there are a couple tricks we can be asked in the exam, and that´s exactly WHERE the Video-on-Demand comes to rescue!

The worse thing that they could ask in the exam about PPP is  Authentication! Otherwise, we just set the encapsulation to ppp bring our interfaces up and that´s pretty much it!

In the PPP Video we get the chance to review some scenarios, not difficult ones, but trick!

First, let´s take a look at the topology used in our simulation (again, I was running it in Dynamips, if anybody wants the .NET files, just let me know):

First scenario: R2 should initiate a secure authentication request to R3.

So, how to complete this task?!

Secure means the password cannot be sent in Clear-Text, so PAP is out, we can use CHAP! CHAP sends a MD5 hash, so it´s good!

But, how can we make sure R2 will initiate the authentication, and not R3?! Well... in fact it´s very simple (I didn´t knew about that so far), use the command ppp authentication chap only in R2. The ppp authentication command only specifies what you´re going to send out  as an authentication requirement not what you´re going to respond to, you always responding to stuff.

So, our configuration will look pretty much like this one:

R2: username R3 password 0 cisco ! interface Serial1/1 ip address 222.222.222.2 255.255.255.0 encapsulation ppp clock rate 128000 ppp authentication chap R3: username R2 password 0 cisco ! interface Serial1/1 ip address 222.222.222.3 255.255.255.0 encapsulation ppp

To BE SURE that R2 is initiating the request, we can run a debug ppp authentication in both routers and check the Outgoing (O) and Incoming (I) requests, take a look yourself:

R2(config-if)#do debug ppp authentication PPP authentication debugging is on R2(config-if)# Se1/1 PPP: Using default call direction Se1/1 PPP: Treating connection as a dedicated line Se1/1 PPP: Session handle[400001F] Session id[63] Se1/1 PPP: Authorization required Se1/1 CHAP: O CHALLENGE id 1 len 23 from "R2" Se1/1 CHAP: I RESPONSE id 1 len 23 from "R3" Se1/1 PPP: Sent CHAP LOGIN Request Se1/1 PPP: Received LOGIN Response PASS Se1/1 PPP: Sent LCP AUTHOR Request Se1/1 PPP: Sent IPCP AUTHOR Request R2(config-if)# Se1/1 LCP: Received AAA AUTHOR Response PASS Se1/1 IPCP: Received AAA AUTHOR Response PASS Se1/1 CHAP: O SUCCESS id 1 len 4 Se1/1 PPP: Sent CDPCP AUTHOR Request Se1/1 CDPCP: Received AAA AUTHOR Response PASS Se1/1 PPP: Sent IPCP AUTHOR Request R2(config-if)# %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to up R3(config-if)#do debug ppp authentication PPP authentication debugging is on R3(config-if)# Se1/1 CHAP: I CHALLENGE id 1 len 23 from "R2" Se1/1 CHAP: Using hostname from unknown source Se1/1 CHAP: Using password from AAA Se1/1 CHAP: O RESPONSE id 1 len 23 from "R3" Se1/1 CHAP: I SUCCESS id 1 len 4 R3(config-if)# %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to up

So what´s next?! Just try to ping from both sides, and you should be ok at your exam! Nothing more to worry about!

Second scenario: R2 and R3 should be configured to PPP Authentication using DIFFERENT secure authentication protocols.

Hmmm... is that possible?! Yeah, it is! We´ll be using CHAP in R2, and EAP in R3, and everything will be good!

Check the configuration of both routers:

R2: username R3 password 0 cisco ! interface Serial1/1 ip address 222.222.222.2 255.255.255.0 encapsulation ppp clock rate 128000 ppp authentication chap  ppp eap password 0 cisco R3: username R2 password 0 cisco ! interface Serial1/1 ip address 222.222.222.3 255.255.255.0 encapsulation ppp ppp authentication eap ppp eap local

Seens pretty straight-forward! Just a quick overview of this configuration:

In R2 the command ppp eap password  cisco needs to be used, because the password in EAP doesn´t need to be symmetric, so we MUST configure it in the CHAP side of the link.

Regarding the ppp eap local configured in R3, this command means, use the LOCAL database (that means username R2 password cisco) for authentication, instead of a Radius Server. If you do not use this command, EAP will expect to have a Radius Server to authenticate the connection, and we do not have it!

Doing that, R2 and R3 will be configured with two different secure authentication protocols! We´re good! That´s what we were asked for!

Take a look at this Debug Output:

R2(config-if)#do debug ppp authentication PPP authentication debugging is on R2(config-if)# %LINK-3-UPDOWN: Interface Serial1/1, changed state to up Se1/1 CHAP: O CHALLENGE id 60 len 23 from "R2" Se1/1 EAP: I REQUEST  IDENTITY id 71 len 5 Se1/1 EAP: O RESPONSE IDENTITY id 71 len 7 from "R2" Se1/1 EAP: I REQUEST  MD5 id 72 len 24 from "R3" Se1/1 CHAP: I RESPONSE id 60 len 23 from "R3" Se1/1 PPP: Sent CHAP LOGIN Request Se1/1 EAP: Using hostname from unknown source Se1/1 EAP: Using password from interface EAP Se1/1 EAP: O RESPONSE MD5 id 72 len 24 from "R2" Se1/1 PPP: Received LOGIN Response PASS Se1/1 PPP: Sent LCP AUTHOR Request Se1/1 PPP: Sent IPCP AUTHOR Request Se1/1 EAP: I SUCCESS id 72 len 4 Se1/1 LCP: Received AAA AUTHOR Response PASS Se1/1 IPCP: Received AAA AUTHOR Response PASS Se1/1 CHAP: O SUCCESS id 60 len 4 Se1/1 PPP: Sent CDPCP AUTHOR Request Se1/1 CDPCP: Received AAA AUTHOR Response PASS Se1/1 PPP: Sent IPCP AUTHOR Request R2(config-if)# %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to up R3(config-if)#do debug ppp authentication PPP authentication debugging is on R3(config-if)# %LINK-3-UPDOWN: Interface Serial1/1, changed state to up Se1/1 EAP: O REQUEST  IDENTITY id 73 len 5 Se1/1 CHAP: I CHALLENGE id 61 len 23 from "R2" Se1/1 CHAP: Using hostname from unknown source Se1/1 CHAP: Using password from AAA Se1/1 CHAP: O RESPONSE id 61 len 23 from "R3" Se1/1 EAP: I RESPONSE IDENTITY id 73 len 7 from "R2" Se1/1 EAP: O REQUEST  MD5 id 74 len 24 from "R3" Se1/1 CHAP: I SUCCESS id 61 len 4 Se1/1 EAP: I RESPONSE MD5 id 74 len 24 from "R2" Se1/1 PPP: Sent CHAP LOGIN Request Se1/1 PPP: Received LOGIN Response PASS Se1/1 PPP: Sent LCP AUTHOR Request Se1/1 PPP: Sent IPCP AUTHOR Request Se1/1 LCP: Received AAA AUTHOR Response PASS Se1/1 IPCP: Received AAA AUTHOR Response PASS Se1/1 EAP: O SUCCESS id 74 len 4 Se1/1 PPP: Sent CDPCP AUTHOR Request Se1/1 CDPCP: Received AAA AUTHOR Response PASS Se1/1 PPP: Sent IPCP AUTHOR Request %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to up

Again, a ping test will not hurt (it worked for me in my Dynamips simulation).

Those are the kind of situations we may encounter during the exam, and for sure, after watching this PPP Video that will not cause me any problems! Cool! :)

There are a lot more tips and advices like that in the Video (not only for PPP, but for everything), you have to check it out! :D