LogoفارسیFA

Hands-On Lab: PPP Authentication Using CHAP (Method 2 — ppp chap hostname/password)

This hands-on lab configures CHAP authentication using the alternative ppp chap hostname and ppp chap password interface commands rather than matching local usernames, a method that scales far better when a single router has many WAN links to different peers.

PPP CHAP HostnamePPP CHAP PasswordScalable CHAP Configuration

~3 min read · Updated Sep 12, 2026

Lab Objective

Configure CHAP authentication between two routers using the interface-level ppp chap hostname and ppp chap password commands instead of the local username database method covered in the previous lab, and verify the resulting authentication succeeds.

Lab Purpose

The matching-username method from the previous lab works well for a single point-to-point link, but becomes unwieldy on a router with dozens of serial interfaces, each needing a different username entry for a different peer. The ppp chap hostname and ppp chap password commands configure the identity presented on a per-interface basis, avoiding the need for a large, centrally managed username database entry per peer.

Lab Topology

R1 ---- Serial0/0/0 (DTE) ------ Serial0/0/0 (DCE) ---- R2

R1: 10.13.13.1/30
R2: 10.13.13.2/30

Both routers already run PPP encapsulation

Task 1: Configure Interface-Level CHAP Identity on R1

On R1's serial interface, configure a specific CHAP hostname and password to present during authentication, rather than relying on R1's actual system hostname.

Task 2: Configure Interface-Level CHAP Identity on R2

On R2's serial interface, configure a matching CHAP hostname and password that R1 will expect to receive.

Task 3: Enable CHAP Authentication

Enable CHAP authentication on both serial interfaces.

Task 4: Configure the Expected Username Entries

On each router, create a local username entry matching the CHAP hostname the OTHER router will present, with the shared password.

Task 5: Verify Authentication Succeeds

Confirm the link comes up and IP connectivity works.

Solution and Verification

R1(config)# username BranchB password SharedKey99
R1(config)# interface serial0/0/0
R1(config-if)# encapsulation ppp
R1(config-if)# ppp chap hostname BranchA
R1(config-if)# ppp chap password SharedKey99
R1(config-if)# ppp authentication chap

R2(config)# username BranchA password SharedKey99
R2(config)# interface serial0/0/0
R2(config-if)# encapsulation ppp
R2(config-if)# ppp chap hostname BranchB
R2(config-if)# ppp chap password SharedKey99
R2(config-if)# ppp authentication chap

R1# debug ppp authentication

PPP Serial0/0/0: CHAP challenge from BranchB
PPP Serial0/0/0: CHAP response received from BranchB
PPP Serial0/0/0: remote passed CHAP authentication

-- Notice the identity exchanged is "BranchB",
-- the configured CHAP hostname, rather than
-- R2's actual system hostname -- this is
-- exactly the flexibility this method provides

R1# show interfaces serial0/0/0

Serial0/0/0 is up, line protocol is up

R1# ping 10.13.13.2

!!!!!
Success rate is 100 percent (5/5)

Key Takeaway

The ppp chap hostname command overrides what identity a specific interface presents during CHAP negotiation, decoupling it from the router's actual system hostname — this becomes essential on a hub router with many spoke connections, since it allows each individual interface to present a distinct identity matching whatever username entry that specific peer expects, without renaming the entire router.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring VTP Clients and Servers on Catalyst Switches

This hands-on lab configures VLAN Trunking Protocol between a server switch and a client switch, demonstrating how VLANs created on the server automatically propagate to the client without manual configuration on every device.

Continue

Hands-On Lab: Configuring Standard VLANs on Catalyst Switches

This hands-on lab covers creating standard-range VLANs, assigning access ports to them, and verifying that devices in different VLANs are properly isolated from each other at Layer 2.

Continue

Hands-On Lab: Verifying IP Parameters on macOS (GUI)

This hands-on lab covers checking a Mac's current IP configuration using the System Settings network panel, viewing detailed TCP/IP information, and renewing a DHCP lease directly from the graphical interface.

Continue

Hands-On Lab: Verifying IP Parameters on Linux (GUI and CLI)

This hands-on lab covers checking a Linux machine's current IP configuration using both the GUI network settings panel and command-line tools, and demonstrates renewing a DHCP lease using standard Linux networking utilities.

Continue

Hands-On Lab: Verifying IP Parameters on Windows (GUI and CLI)

This hands-on lab covers checking a Windows PC's current IP configuration using both the graphical Network Connections interface and the command-line ipconfig utility, including releasing and renewing a DHCP-assigned address.

Continue

Hands-On Lab: Power over Ethernet (PoE) Basics

This hands-on lab covers verifying PoE capability on a switch port, checking how much power is being drawn by a connected device such as an IP phone or access point, and configuring power priority to protect critical devices during a power budget shortage.

Continue
Previous ArticleNext Article