LogoفارسیFA

Hands-On Lab: PPP Authentication Using PAP

This hands-on lab configures PAP authentication on a PPP serial link, demonstrating the simple two-way username and password exchange PAP uses, and shows what happens when the configured credentials do not match between the two routers.

PPP PAP AuthenticationSerial Link SecurityUsername Password Configuration

~3 min read · Updated Sep 12, 2026

Lab Objective

Configure PAP authentication between two routers running PPP, verify successful authentication, then introduce a credential mismatch and observe the resulting failure.

Lab Purpose

PAP is one of two standard PPP authentication methods, and while it sends credentials in clear text (a security weakness covered in more depth when comparing it to CHAP in a later lab), it remains a fundamental building block for understanding WAN link security and is still occasionally required for compatibility with older equipment.

Lab Topology

R1 ---- Serial0/0/0 (DTE) ------ Serial0/0/0 (DCE) ---- R2

R1: 10.11.11.1/30
R2: 10.11.11.2/30

Both routers already run PPP encapsulation,
as configured in the previous lab

Task 1: Configure Usernames on Both Routers

On R1, create a local username matching R2's hostname with an agreed-upon password. On R2, create a local username matching R1's hostname with the same password.

Task 2: Enable PPP and PAP

Ensure PPP encapsulation is set, then enable PAP authentication on both serial interfaces.

Task 3: Configure the Outbound PAP Credentials

On each router's interface, specify the username and password to send to the remote peer during authentication.

Task 4: Verify Successful Authentication

Confirm the link authenticates successfully and IP connectivity works.

Task 5: Introduce a Password Mismatch

Change the password in R2's local username database without updating R1's outbound credentials, then observe the resulting authentication failure.

Solution and Verification

R1(config)# username R2 password Cisco123
R1(config)# interface serial0/0/0
R1(config-if)# encapsulation ppp
R1(config-if)# ppp authentication pap
R1(config-if)# ppp pap sent-username R1 password Cisco123

R2(config)# username R1 password Cisco123
R2(config)# interface serial0/0/0
R2(config-if)# encapsulation ppp
R2(config-if)# ppp authentication pap
R2(config-if)# ppp pap sent-username R2 password Cisco123

R1# show interfaces serial0/0/0

Serial0/0/0 is up, line protocol is up
  Encapsulation PPP

R1# ping 10.11.11.2

!!!!!
Success rate is 100 percent (5/5)

R2(config)# username R1 password WrongPassword

R1# show interfaces serial0/0/0

Serial0/0/0 is up, line protocol is down

R1# debug ppp authentication

PPP Serial0/0/0: remote passed PAP authentication
PPP Serial0/0/0: Send PAP Auth-Nak
-- R2 rejects R1's credentials, since R2's
-- local username database no longer has the
-- matching password R1 is sending

R2(config)# username R1 password Cisco123

R1# show interfaces serial0/0/0
Serial0/0/0 is up, line protocol is up

Key Takeaway

Each router's local username command defines what credentials it expects to RECEIVE from a peer, while ppp pap sent-username defines what credentials it SENDS — these are easy to confuse, and a mismatch on either side (expected versus sent) produces the identical authentication failure, so both must be checked during troubleshooting.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring VTP Clients and Servers on Catalyst Switches

This hands-on lab configures VLAN Trunking Protocol between a server switch and a client switch, demonstrating how VLANs created on the server automatically propagate to the client without manual configuration on every device.

Continue

Hands-On Lab: Configuring Standard VLANs on Catalyst Switches

This hands-on lab covers creating standard-range VLANs, assigning access ports to them, and verifying that devices in different VLANs are properly isolated from each other at Layer 2.

Continue

Hands-On Lab: Verifying IP Parameters on macOS (GUI)

This hands-on lab covers checking a Mac's current IP configuration using the System Settings network panel, viewing detailed TCP/IP information, and renewing a DHCP lease directly from the graphical interface.

Continue

Hands-On Lab: Verifying IP Parameters on Linux (GUI and CLI)

This hands-on lab covers checking a Linux machine's current IP configuration using both the GUI network settings panel and command-line tools, and demonstrates renewing a DHCP lease using standard Linux networking utilities.

Continue

Hands-On Lab: Verifying IP Parameters on Windows (GUI and CLI)

This hands-on lab covers checking a Windows PC's current IP configuration using both the graphical Network Connections interface and the command-line ipconfig utility, including releasing and renewing a DHCP-assigned address.

Continue

Hands-On Lab: Power over Ethernet (PoE) Basics

This hands-on lab covers verifying PoE capability on a switch port, checking how much power is being drawn by a connected device such as an IP phone or access point, and configuring power priority to protect critical devices during a power budget shortage.

Continue
Previous ArticleNext Article