Lab Objective
Configure PAP authentication between two routers running PPP, verify successful authentication, then introduce a credential mismatch and observe the resulting failure.
Lab Purpose
PAP is one of two standard PPP authentication methods, and while it sends credentials in clear text (a security weakness covered in more depth when comparing it to CHAP in a later lab), it remains a fundamental building block for understanding WAN link security and is still occasionally required for compatibility with older equipment.
Lab Topology
R1 ---- Serial0/0/0 (DTE) ------ Serial0/0/0 (DCE) ---- R2
R1: 10.11.11.1/30
R2: 10.11.11.2/30
Both routers already run PPP encapsulation,
as configured in the previous labTask 1: Configure Usernames on Both Routers
On R1, create a local username matching R2's hostname with an agreed-upon password. On R2, create a local username matching R1's hostname with the same password.
Task 2: Enable PPP and PAP
Ensure PPP encapsulation is set, then enable PAP authentication on both serial interfaces.
Task 3: Configure the Outbound PAP Credentials
On each router's interface, specify the username and password to send to the remote peer during authentication.
Task 4: Verify Successful Authentication
Confirm the link authenticates successfully and IP connectivity works.
Task 5: Introduce a Password Mismatch
Change the password in R2's local username database without updating R1's outbound credentials, then observe the resulting authentication failure.
Solution and Verification
R1(config)# username R2 password Cisco123
R1(config)# interface serial0/0/0
R1(config-if)# encapsulation ppp
R1(config-if)# ppp authentication pap
R1(config-if)# ppp pap sent-username R1 password Cisco123R2(config)# username R1 password Cisco123
R2(config)# interface serial0/0/0
R2(config-if)# encapsulation ppp
R2(config-if)# ppp authentication pap
R2(config-if)# ppp pap sent-username R2 password Cisco123R1# show interfaces serial0/0/0
Serial0/0/0 is up, line protocol is up
Encapsulation PPP
R1# ping 10.11.11.2
!!!!!
Success rate is 100 percent (5/5)R2(config)# username R1 password WrongPassword
R1# show interfaces serial0/0/0
Serial0/0/0 is up, line protocol is down
R1# debug ppp authentication
PPP Serial0/0/0: remote passed PAP authentication
PPP Serial0/0/0: Send PAP Auth-Nak
-- R2 rejects R1's credentials, since R2's
-- local username database no longer has the
-- matching password R1 is sendingR2(config)# username R1 password Cisco123
R1# show interfaces serial0/0/0
Serial0/0/0 is up, line protocol is upKey Takeaway
Each router's local username command defines what credentials it expects to RECEIVE from a peer, while ppp pap sent-username defines what credentials it SENDS — these are easy to confuse, and a mismatch on either side (expected versus sent) produces the identical authentication failure, so both must be checked during troubleshooting.