Downloads |
Table Of Contents
MS-CHAP Support
Feature Summary
Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) is the Microsoft version of CHAP and is an extension to RFC 1994. Like the standard version of CHAP, MS-CHAP is used for PPP authentication; in this case, authentication occurs between a PC using Microsoft Windows NT or Microsoft Windows 95 and a Cisco router or access server acting as a network access server (NAS).
MS-CHAP differs from the standard CHAP as follows:
•
MS-CHAP is enabled by negotiating CHAP Algorithm 0x80 in LCP option 3, Authentication Protocol.
•
•
•
•
Depending on the security protocols you have implemented, PPP authentication using MS-CHAP can be used with or without Authentication, Authorization and Accounting (AAA) security services. If you have enabled AAA, PPP authentication using MS-CHAP can be used in conjunction with both TACACS+ and RADIUS. Two new vendor-specific RADIUS attributes (IETF Attribute 26) were added to enable RADIUS to support MS-CHAP. These new attributes are listed in Table 1.
For a complete list of supported IETF and vendor-proprietary RADIUS attributes, refer to the "RADIUS Attributes" appendix in the Cisco IOS Release 11.3 Security Configuration Guide.
Benefits
MS-CHAP enables PPP authentication between a PC using Microsoft Windows 95 or Microsoft Windows NT and a Cisco router or access server.
Platforms
The following platforms support MS-CHAP:
•
•
•
•
•
•
•
Prerequisites
If you are using RADIUS or TACACS+, you must configure security using AAA network security services before you can configure your NAS for PPP authentication using MS-CHAP. To configure security on a Cisco router or access server using AAA, complete the following tasks:
1
2
3
4
5
6
For detailed information about any of the commands listed above, refer to the Cisco IOS Release 11.3 Security Command Reference.
Supported MIBs and RFCs
No MIBs are supported by this feature.
This feature is an extension to RFC 1994, "PPP Challenge Handshake Authentication Protocol (CHAP)," dated August 1996 and written by W. Simpson.
Configuration Tasks
To enable PPP authentication using MS-CHAP, perform the following tasks in interface configuration mode
Enable PPP encapsulation.
encapsulation ppp
Define PPP authentication using MS-CHAP.
ppp authentication ms-chap [if-needed] [list-name | default] [callin] [one-time]
If you configure ppp authentication ms-chap on an interface, all incoming calls on that interface that initiate a PPP connection will have to be authenticated using MS-CHAP. If you configure the ppp authentication command with the callin keyword, the access server will only authenticate the remote device if the remote device initiated the call.
Authentication method lists and the one-time keyword are only available if you have enabled AAA—they will not be available if you are using TACACS or Extended TACACS. If you specify the name of an authentication method list with the ppp authentication command, PPP will attempt to authenticate the connection using the methods defined in the specified method list. If AAA is enabled and no method list is defined by name, PPP will attempt to authenticate the connection using the methods defined as the default. The ppp authentication command with the one-time keyword enables support for one-time passwords during authentication.
The if-needed keyword is only available if you are using TACACS or Extended TACACS. The ppp authentication command with the if-needed keyword means that PPP will only authenticate the remote device via MS-CHAP if that device has not yet authenticated during the life of the current call. If the remote device authenticated through a standard login procedure and initiated PPP from the EXEC prompt, PPP will not authenticate through MS-CHAP if ppp authentication chap if-needed is configured.
Note
Configuration Example
The following example configures a Cisco AS5200 (enabled for AAA and communication with a RADIUS security server) for PPP authentication using MS-CHAP:
aaa new-modelaaa authentication login admins localaaa authentication ppp dialins radius localaaa authorization network radius localaaa accounting network start-stop radiususername root password ALongPasswordradius-server host alcatrazradius-server key myRaDiUSpassWoRdinterface group-async 1group-range 1 16encapsulation pppppp authentication ms-chap dialinsline 1 16autoselect pppautoselect during-loginlogin authentication adminsmodem dialinThe lines in this sample RADIUS AAA configuration are defined as follows:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Command Reference
This section documents the modified ppp authentication command. All other commands used with this feature are documented in the Cisco IOS Release 11.3 command references.
ppp authentication
To enable CHAP or PAP or both and to specify the order in which CHAP and PAP authentication are selected on the interface, use the ppp authentication interface configuration command. Use the no form of this command to disable this authentication.
ppp authentication {chap | chap pap | pap chap | pap | ms-chap} [if-needed]
[list-name | default] [callin] [one-time]
no ppp authenticationSyntax Description
CautionIf you use a list-name value that was not configured with the aaa authentication ppp command, you will disable PPP on this interface.
Default
PPP authentication is not enabled.
Command Mode
Interface configuration
Usage Guidelines
This command first appeared in Cisco IOS Release 10.0.
When you enable CHAP or PAP authentication (or both), the local router requires the remote device to prove its identity before allowing data traffic to flow. PAP authentication requires the remote device to send a name and a password, which is checked against a matching entry in the local username database or in the remote security server database. CHAP authentication sends a challenge to the remote device. The remote device encrypts the challenge value with a shared secret and returns the encrypted value and its name to the local router in a Response message. The local router attempts to match the remote device's name with an associated secret stored in the local username or remote security server database; it uses the stored secret to encrypt the original challenge and verify that the encrypted values match.
You can enable PAP or CHAP (or both) in either order. If you enable both methods, the first method specified is requested during link negotiation. If the peer suggests using the second method, or refuses the first method, the second method is tried. Some remote devices support only CHAP and some support only PAP. Base the order in which you specify methods on the remote device's ability to correctly negotiate the appropriate method, and on the level of data line security you require. PAP usernames and passwords are sent as clear text strings, which can be intercepted and reused. CHAP has eliminated most of the known security holes.
MS-CHAP is the Microsoft version of CHAP. Like the standard version of CHAP, MS-CHAP is used for PPP authentication; in this case, authentication occurs between a PC using Microsoft Windows NT or Microsoft Windows 95 and a Cisco router or access server acting as a network access server (NAS).
Enabling or disabling PPP authentication does not affect the local router's willingness to authenticate itself to the remote device.
If you are using autoselect on a TTY line, you probably want to use the ppp authentication command to turn on PPP authentication for the corresponding interface.
Example
The following example enables CHAP on asynchronous interface 4 and uses the authentication list MIS-access:
interface async 4encapsulation pppppp authentication chap MIS-accessRelated Commands
aaa authentication ppp
aaa new-model
autoselect
encapsulation ppp
ppp-use-tacacs
username
