CCNA

CCNA Study Guide
online cisco ccna training guide – collection of high quality CCNA tutorials.
These tutorials are prepared with single slogan; “provide best online CCNA training absolutely free”. This comprehensive collection of CCNA Study material is exactly; what you need to prepare for following exams CCNA Routing and Switching; Cisco Certified Entry Networking Technician (CCENT), Interconnecting Cisco Networking Devices – part 1 (ICND-1); Interconnecting Cisco Networking Devices – part 2 (ICND-2). CCNA certificate is a goal in your career journey. So to get this goal we arranged this exclusive CCNA training program in such a way that you get advantage from these CCNA tutorials in exam and after getting certificate in your job life.

CISA-Exam

/

How many exams does CCNP enterprise have?

, 0 Comments

CCNP Certification stands for Cisco certified network professional certification. This certification is available for IT professionals who have at least one year of experience in networking and want to upgrade their skills to perform better and earn better in the market. In addition, CCNP certification is especially for the people who want to specialize in implementing, maintaining, and planning Cisco’s high-end network solution products. Some of the significant courses that Cisco certification covers are as follows:

  • Cisco remote access
  • Cisco advanced routing
  • Cisco multilayer switching
  • Converged network optimization
  • Scalable internetworks.

This certification trains the professionals to troubleshoot, install and maintain WAN (Wide Area Network) and LAN (Local Area Network). In addition, router redistribution, access lists, ethernet and Appletalk, are some extended expertise that Cisco certificate holders gain.

Are CCNP and CCNA the same or different?

It is the most frequently asked question that might cause confusion in people’s minds. CCNA and CCNP are different from each other, and the following is the difference described in a nutshell.

CCNA is an associate-level certification that examines the professionals’ expertise in switching and routing fundamentals. On the other hand, CCNP is an advanced level of certification that asks for the deeper knowledge of networks, including Wide Area Network and Local Area Networks. Both CCNA and CCNP are Cisco certifications, but CCNP is senior to CCNA because it requires a more profound and strong understanding of networks and their security and other components of the system.

How many exams does CCNP enterprise have?

Before attempting for a CCNP exam, you must know that you will have to take two exams to get CCNP Enterprise certifications. These two exams are the core exam and concentration exam. So now you will be thinking about the difference between the core exam and the concentration exam. We are mentioning the difference below:

The core exam covers the knowledge related to infrastructures of the networks, including dual-stack, architecture, infrastructure, virtualization, security, network assurance and automation. The concentration exam emphasizes industry-specific subjects like SD-WAN, Network Design, automation, and wireless on the flip card.

Which CCNP enterprise exam should I take first?

It depends on different situations and different people, which specialty exam should one take first. But we would try to encapsulate the answer in short sentences.

  • The people who are aspiring to have a network engineering cert as old CCNP routing and switching should take ENARSI (300-410) CCNP first.
  • If you want to excel in SD-WAN and edge routing solutions, you should first take ENSDWI  (300-415).
  • The people who want to design enterprise networks should opt for ENSLD (300-420).
  • The wireless design engineers should take ENWLSI (300-430) enterprise speciality exam.
  • Network automation engineers should get their hands on the ENAUTO (300-435) enterprise speciality exam.

Which enterprise exam every candidate must take?

ENCOR (300-401) is the core enterprise exam that everyone must take. The best thing about the enterprise core exam is that it covers the skills and principles of enterprise networks. These skills and principles include troubleshooting, management, security, and some other significant components of enterprise networking. Therefore, taking this exam will not only enhance your skills related to enterprise networking but also help you upgrade your professional career.

How to prepare for the CCNP Enterprise exam?

Here comes the most frequently asked question from where you should prepare for your CCNP enterprise exams. Many online platforms are offering the opportunity to guide you about the whole examination system. However, if you are also seeking ultimate tuition for your CCNP exam, the CCNP Enterprise exam dumps practice and studying by SPOTO is the best way to pass the exam and upgrade your career. We know that the CCNP enterprise exam is not child’s play. That’s why we have a crew of highly professional and experienced trainers that have been working for several years in the market.

If you wonder why you should choose us instead of others in the market, the following points will help you understand the perks of choosing us.

  • We provide 100% real exam practice tests.
  • We give 100% verified exams questions and answers.
  • You can now practice for only five days and pass your enterprise exam.
  • We have excellent, professional and experienced teams of tutors.

What can be better than having so many benefits under one roof? Of course, nothing! So, what are you exactly waiting for then? Register yourself now and get ahead of the game!

CCNA 200-301

CCNA 200-301 Free Exam Questions & Answers

, 0 Comments

Have you ever faced a situation where you have to prepare for the exam but you aren’t sure what kind of questions you can face in the exam?

But if you are one of those who are preparing for the CCNA 200-301 exam, then the problem has been solved because below are the CCNA 200-301 free exam questions & answers only to help you get through this situation.

Read them all and get prepared for the exam with us.

Questions & Answers

Here is your 200-301 practice test free with a list of 7 questions and their answers that will not only tell you what kind of exam you are going to face but will also help you prepare for the kind of questions you will get in the exams.

Start reading and start revising:

Q. A single-line ACL has been added to a router configuration using the command IP access-list 1 permit 172.16.4.0 0.0.1.255. The configuration also includes the access-class 1 in command in VTY configuration mode. Which answer accurately describes how the router uses ACL 1?

  1. Hosts in subnet 172.16.4.0/23 alone can log in but cannot reach enable mode of the router.
  2. Hosts in subnet 172.16.4.0/23 alone can telnet into the router.
  3. The router will only forward packets with source addresses in subnet 172.16.4.0/23.
  4. CLI users cannot telnet from the router to hosts in subnet 172.16.4.0/23 alone.

Answer: 2

Q. What is the same for both copper and fiber interfaces when using SFP modules?

  1. They offer reliable bandwidth up to 100 Mbps in half-duplex mode
  2. They accommodate single-mode and multi-mode in a single module.
  3. They support an inline optical attenuator to enhance signal strength.
  4. They provide minimal interruption to services by being hot-swappable.

Answer: 4

Q. Which of the following statements is true about classless IP addressing concepts?

  1. Ignores Class A, B, and C network rules.
  2. Uses a 128-bit IP address.
  3. Separates IP addresses into a network, subnet, and host parts.
  4. Applies only for Class A and B networks.

Answer: 1

Q. What are the two functions of a server on a network? (Select two answers).

  1. Achieves redundancy by exclusively using virtual server clustering.
  2. Housed solely in a data center that is dedicated to a single client.
  3. Runs applications that send and retrieve data for workstations that make requests.
  4. Handles requests from multiple workstations at the same time.
  5. Runs the same operating system to communicate with other servers.

Answer: 3 and 4

Q. An enterprise moves away from manual configuration methods, making changes by editing centralized configuration files. Which answers list an issue solved by using a version control system with those centralized files? (Select two answers).

  1. The ability to find the details of what changed in the configuration file over time.
  2. The ability to use a template with per-device variables to create configurations.
  3. The ability to find which engineer changed the central configuration file on a date/time.
  4. The ability to recognize configuration drift in a device and notify the staff.

Answer:  1 and 3

Q. Does the Wi-Fi Alliance offer which of the following certifications for wireless devices that correctly implement security standards?

  1. WPA2
  2. AES
  3. WEP
  4. 802.11

Answer: 1

Q. What is a recommended approach to avoid co-channel congestion while installing access points that use the 2.4 GHz frequency?

  1. One nonoverlapping channel
  2. One overlapping channel
  3. Different overlapping channels
  4. Different nonoverlapping channels

Answer: 4

So, now do you have an idea what kind of questions will be asked to you in the exam and how? if yes then go and start preparing for it now and if no then read the questions again and absorb them until the concept of the CCNA 200-301 exam becomes clear to you.

To Sum Up:

Having a sample paper for an upcoming exam is a great idea. Knowing what to prepare and how you will be asked questions release a lot of tension, stress, and anxiety. But now that you have some CCNA 200-301 free exam questions and answers, we are pretty sure you can give the exam confidently.

For more updates, stay tuned and keep reading!

CCNA Certification

Advance Your Career By Grabbing Cisco CCNA Certification And Open The Door To Limitless Opportunities In The IT Sector

, 0 Comments

Are you wondering how useful the Cisco CCNA certification can be for your career progress? No need to guess because it will be the best decision for you if you want to become proficient in network fundamentals, IP services, network access, and security fundamentals. Adding this accreditation to your resume will provide you with a solid validation of your knowledge and skills as well as open you up to a variety of career opportunities. Once you achieve the CCNA accreditation, you can showcase it on your profile to attract potential employers, which significantly increases your chances of getting the desired job. Do you want to learn more about this valuable designation and the benefits it brings? Then keep reading the paragraphs below!

What Is the Cisco 200-301 Exam? 

To achieve the prestigious Cisco CCNA certification, you will have to pass the 200-301 exam. The test has an allocated duration of 120 minutes and within this set timeframe, the examinees are required to answer around 100-120 questions. The evaluation is delivered in two languages, English and Japanese, and costs each applicant $300 plus applicable taxes. To get better clarity of the test and pass it with flying colors, the candidates need to master each domain of the exam syllabus in detail. Besides, the potential test-takers are recommended to have at least 1 year of professional experience in implementing and administering Cisco solutions. The understanding of basic IP addressing and network fundamentals will be also of help. 

Career Opportunities for the Cisco CCNA Certification Holders

Now that you know how to achieve the Cisco CCNA accreditation, you should be interested in the advantages you can get as a certified professional. After passing the Cisco 200-301 exam, you will be exposed to many career opportunities in the IT sector. This is because Cisco is a famous vendor and its certifications are accepted by the top companies all over the world. The individuals who hold the Cisco designation have credibility in the job market as the employers can rely on their expertise. Well, some of the job roles you can take up after achieving the certificate are as follows: 

  • Network Administrator 
  • Systems Administrator 
  • Network Analyst 
  • Network Engineer

When it comes to the compensation for Cisco CCNA professionals, a Network Administrator can earn an average salary of $63,767 yearly, while a Systems Administrator can have an annual income of $66,891, as revealed by Payscale.com. A Network Analyst holding the CCNA accreditation can earn on average $61,167 per year. In its turn, a certified Network Engineer can get a remuneration of $76,081 annually.  

Conclusion No matter how tough it seems to get the Cisco CCNA certification, this designation clears your path and paves the road to success in your professional life. The Cisco CCNA accreditation will advance your career and provide you a chance to work in a high position within reputable firms. All you have to do is to be passionate and put in a lot of hard work to achieve this Cisco certification. Prepare diligently for the Cisco 200-301 exam and embark on enhancing your expertise in the IT field.

Static Mapping command Examination

0 Comments

We earlier discussed that Cisco routers support all network layer protocols over Frame Relay. We also know that the address-to-DLCI mapping can be accomplished both by dynamic or static mapping. Frame Relay static mapping ever depends on the network needs. To map between a next hop protocol address and DLCI destination address, the follow command syntax can be used:

frame-relay map protocol protocol-address dlci[broadcast] [ietf] [cisco].

The “ietf” parameter can be used when you want to connect a non-Cisco router.

Another parameter in the command is “broadcast”; this parameter specifies that broadcast and multicast traffic is permitted over the VC. It is permits the use of dynamic routing protocols over the VC. Due to broadcast the configuration of Open Shortest Path First (OSPF) protocol can be significantly simplified.

Frame Relay, ATM, and X.25 are non-broadcast multiaccess (NBMA) networks. Non-broadcast multiaccess (NBMA) based networks only allow data transfer from point to point, over a VC, or across a switching device. Non-broadcast multiaccess (NBMA) networks do not allow multicasting or broadcasting, therefore a single packet cannot reach to all destinations.

The single packet required to replicate the packets manually to all destinations. Using the broadcast keyword is a way to send and forward routing updates. The broadcast keyword support IPv4 broadcasts and multicasts to be propagated to all nodes. Broadcast also allows IPv6 multicasts over the PVC. When this keyword is enabled, the router converts the broadcast or multicast traffic into unicast traffic so that other nodes receive the routing updates.

The “protocol” parameters defines the supported protocol, bridging or logical link control: IPv4, IPv6, Apple Talk, decnet, dlsw, ipx, rsrb, vies, llc2 and xns.

The “procol address” defines the network layer address of the destination router interface.

The “dlci” defines t local DLCI used to connect to the remote protocol address.

Frame Relay Address Mapping Exclusive

1 Comment

Cisco routers support all network layer protocols such as IPv4, IPv6, IPX, and AppleTalk over Frame Relay. For transmitting data over Frame Relay, it needs to know which local DLCI maps to the Layer 3 address of the remote destination. In simple words Frame Relay address mapping matches a next-hop IP address that sits on the Frame Relay network with the local DLCI used to send frames to that next-hop device. It is working just like ARP on a LAN. This address-to-DLCI mapping can be accomplished both by static or dynamic mapping. Before discussing the Frame Relay mapping, we will discuss the Inverse ARP.

Inverse ARP

The Inverse Address Resolution Protocol (ARP) is the primary tool for Frame Relay. Inverse ARP is the opposite of the ARP. ARP translates Layer 3 addresses to Layer 2 addresses. But Inverse ARP get Layer 3 addresses of other stations from Layer 2 addresses, such as the DLCI in Frame Relay networks. Inverse ARP is usually used in Frame Relay and ATM networks.

Frame Relay for IPv6 uses Inverse Neighbor Discovery to get a Layer 3 IPv6 address from a Layer 2 DLCI. A Frame Relay router sends an Inverse Neighbor Discovery Solicitation message to request a Layer 3 IPv6 address corresponding to a Layer 2 DLCI address of the remote Frame Relay router. At the similar time the Inverse Neighbor Discovery Solicitation message provides the sender’s Layer 2 DLCI address to the remote Frame Relay router.

Dynamic Frame Relay Address Mapping

Frame Relay Dynamic address mapping depends on Inverse ARP to determine a next-hop IPv4 address to a local DLCI value. The Frame Relay router sends out Inverse ARP requests on its PVC to find out the address of the far-end device connected to the Frame Relay network. The router uses the responses to populate an address-to-DLCI mapping table on the Frame Relay router. The Cisco Routers enabled Inverse ARP by default, no additional command is required to configure dynamic Frame Relay mapping on an interface.

The router make and maintains this mapping table, which included all determined Inverse ARP requests with both dynamic and static mapping entries. Cisco routers have enabled Inverse ARP, by default, for all protocols on the physical interface. Inverse ARP packets are not sent out for protocols that are not enabled on the interface.

Static Frame Relay Address Mapping

A network administrator can compute a manual static mapping for the next hop address and can override dynamic Inverse ARP mapping by supplying a manual static map address to a local DLCI. A static Frame Relay mapping works similar to dynamic Inverse ARP by associating a particular next-hop protocol address to a local Frame Relay DLCI. We cannot use Inverse ARP and a map statement for the same DLCI and protocol.

If the router of the remote side does not support dynamic Inverse ARP for a specific network, then the network administrator can use static Frame Relay mapping. Static Frame Relay mapping will complete the remote network layer address to local DLCI resolution in the above example.

Another use of static Frame Relay mapping is a hub-and-spoke Frame Relay network. Network administrator uses static Frame Relay address mapping on the spoke routers to provide spoke-to-spoke reach ability.

We earlier discussed the Hub and Spoke, and we know that the spoke routers do not have direct connectivity with each other so, dynamic Inverse ARP would not work between them. Dynamic Inverse ARP work if there are direct point-to-point connections available between two ends. In the Hub and Spok network, the dynamic Frame Relay mapping will only work between the Hub and Spoke, and the spokes require static mapping to provide connectivity to each other. In the next article we will discuss the configuration of static Frame Relay mapping.

Frame Relay Encapsulation

Frame Relay Encapsulation – Exclusive Explanation

0 Comments

As we earlier discussed that Frame Relay is working on the Datalink Layer of the OSI Model. So, it takes data packets from the upper layer of the OSI model, encapsulates the data into Frame Relay frame, and then passes the frame to the physical layer of the OSI Model for delivery on the network. Frame Relay encapsulation is important to understand because it is helpful to understand how Frame Relay is working. Frame Relay encapsulates data for sending over the network, as shown in Figure 1.

Frame Relay Encapsulation

During the Frame Relay encapsulation process, it accepts a packet from a network layer protocol, such as IPv4 or IPv6. Frame Relay Encapsulation process makes changes with an address field that contains the DLCI and a checksum.

Flag fields are added to indicate the beginning and end of the frame. It is mark the start and end of the frame with same values. It is either represented as the hexadecimal number 7E or as the binary number 01111110. Frame Relay encapsulates the packet and pass the frame to the physical layer for transport.

The CPE encapsulates each Layer 3 packet inside a Frame Relay header and trailer before sending it across the Virtual Circuit (VC). The header and trailer are defined by LAPF. The Frame Relay header address field specifically contains the following fields as shown in the figure:

  • DLCI – DLCI is the most important fields in the Frame Relay header. DLCI represents the virtual connection between the DTE device and the switch. All virtual connection (VCs) that is multiplexed on to the physical channel is represented by a unique DLCI. I earlier says that DLCI values are local significance, so they are unique only to the physical channel on which they exist. Thus, devices at opposite ends of a connection can use different DLCI values to refer to the same virtual connection.
  • C/R – C/R bit follows the most significant DLCI byte in the Address field.
  • EA – EA is stand for Extended Address. If the value of this field is 1, the current byte is determined to be the last DLCI octet. Even if current Frame Relay implementations all use a two-octet DLCI, this capability does allow longer DLCIs in the future. Last bit of each byte of the Address field indicates the EA.
  • Congestion Control– Congestion Control has three bits referred to as the Forward Explicit Congestion Notification (FECN), Backward Explicit Congestion Notification (BECN), and Discard Eligible (DE) bits.

The frame relay frame is forwarded to physical layer of the OSI model for transmission. Physical Layer is typically EIA/TIA-232, 449, V.35, or X.21. The Frame Relay frame is a member of the HDLC frame type; therefore, it is enclosed with flag fields.

The 8-bit flag uses the bit pattern 01111110. The FCS determines whether any errors in the Layer 2 address field occurred during transmission. The sending node checks and calculates FCS before sending it. At the far-away end, a second FCS value is calculated and compared to the FCS in the frame. If both values are matched, the frame is processed. If there is dissimilarity, the frame is discarded. Frame Relay never notifies the source when if a frame is discarded. Error control is left to the upper layers of the OSI model.

Multiple-VCs

Multiple Virtual Circuits (VCs) – Briefly Explained

3 Comments

Frame Relay is a multiplexing technique that transmits only one frame at a time. Multiple virtual circuits can be used on a single physical line. The Frame Relay Access Device (FRAD), or router connected to the Frame Relay network, may have multiple virtual circuits linking it to different endpoints.

Multiple VCs on a single physical line is distinguished because each Virtual Circuit has its own DLCI. I have mentioned in the previous article that the DLCI has local significance and may be different at each end of a VC.

Multiple Virtual Circuits reduces the number of equipment and network also reduces the network complexity. Using Multiple Virtual Circuits makes the network very cost-effective. With this configuration, each endpoint required a single access line and a single interface.

The figure-1 below illustrates the example of Multiple Virtual Circuits of the central office with its remote locations. Central Office is connected to the network using two VCs and each VC is assigned a DLCI.

Multiple Virtual Circuits

As I mentioned earlier that Frame Relay decreases the network cost because customers only pay for the bandwidth they use and for the port they are using. When the customer needs more ports, they pay for more bandwidth, but they do not pay for equipment because all the ports in Frame Relay are virtual.

Frame Relay Virtual Circuits

Frame Relay Virtual Circuits (VCs) – Exclusiv Explanation

, 3 Comments

We have already discussed Frame Relay in the previous lessons What is Frame Relay? Exclusive Introduction that it provides connection-oriented data link layer communication using a Frame Relay virtual circuit. Frame Relay Virtual Circuits (VCs) is a logical connection between two data terminal equipment (DTE) devices across a Frame Relay packet-switched network (PSN). The circuits are virtual because there is no direct electrical connection from one side to another side.

The connection is logical, and data moves from end to end, without a direct electrical circuit. With Virtual Circuits (VCs), Frame Relay shares the bandwidth among multiple users and any single site can communicate with any other single site without using multiple dedicated physical lines.

Bidirectional communication is possible on the single physical line due to the data-link connection identifier (DLCI). Using DLCI a number of virtual circuits can be multiplexed into a single physical circuit for transmission across the network. There are two types of VCs:

  • Switched Virtual Circuits (SVC): A switched virtual circuit (SVC) provides a temporary connection between two different network nodes until completion of a data transfer session, after which the connection is terminated. Svc has different states e.g. CALL SETUP, DATA TRANSFER, IDLE, and CALL TERMINATION.
  • Permanent Virtual Circuits (PVCs): A permanent virtual circuit (PVC) provides a dedicated permanent virtual circuit to the user but actually, this permanent virtual circuit ( PVC) is a part of a shared pool of circuit resources used to support multiple users as they require the connections. PVCs are more commonly implemented than SVCs.

Frame Relay creates a Virtual Circuit by storing input-port to output-port mapping in the memory of each switch and thus links one switch to another until a continuous path from one end of the circuit to the other is identified. A Virtual Circuit can pass through any number of intermediate devices (switches) located within the Frame Relay network.

Virtual Circuits (VCs) provide a bidirectional communication path from one device to another. VCs are known by DLCIs, as shown in Figure 1. DLCIs value is not unique in the Frame relay network due to its local implication. A DLCI identifies a VC to the equipment at an endpoint. So, a DLCI has no significance further than the single link. Devices connected by a VC may use a different DLCI value to refer to the same connection.

Frame Relay Virtual Circuits (VCs)

As we know that DLCIs are locally significant, so the same address can be used in several different locations while still referring to different connections. Local addressing also prevents a customer from running out of DLCIs as the network grows.

In Frame Relay Network, the frames moves across the network, Frame Relay labels each VC with a DLCI number. The DLCI number is stored in the address field of every frame transmitted to tell the network how the frame should be routed. Usually, DLCIs 0 to 15 and 1,008 to 1,023 are reserved. So the Frame Relay service providers typically assign DLCIs in the range of 16 to 1,007.

Challange-Handshake-Authentication-Protocol-CHAP

How to Configure Challenge Handshake Authentication Protocol (CHAP)

, , 7 Comments

Challenge Handshake Authentication Protocol (CHAP) periodically checks the character of the far off hub utilizing a three-way handshake. The hostname on one switch must match the username the other switch has designed. The passwords should likewise coordinate. The password value is variable and changes unpredictably while the link exists.

When the PPP link establishment phase is complete, the local router sends a challenge message to the remote node containing Challenge Handshake Authentication Protocol (CHAP) user name and a hash value that is based on the Challenge Handshake Authentication Protocol (CHAP)Password. 

The remote router compares the local routers username and password in its local database and calculates hash value with the value sent from local router. The remote node then responds with a calculated value using a one way hash function, usually with Message Digest 5 (MD5) based on the password and challenge message. The figure1 illustrates the CHAP 3 way handshake.

The local router checks the reaction against its own calculation of the likely hash value. In case of value match, the initiating node acknowledges the authentication; otherwise, the initiating node immediately terminates the connection.

Challenge Handshake Authentication Protocol (CHAP)

Challenge Handshake Authentication Protocol (CHAP) provides better protection then PAP because it protects devices from playback attacks using a variable challenge value that is unique and unpredictable. The challenge and resulted hash value are unique and random. The use of repetitive challenges limits the time of vulnerability to any single attack. The local router or a third-party authentication server is in control of the frequency and timing of the challenges.

Challenge Handshake Authentication Protocol (CHAP) Configuration

We have learnt in the previous section that CHAP periodically identifies the remote node using a three-way handshake. The hostname on one router should match the username the other router has configured. The passwords also required to match. This occurs on initial link establishment and can be repeated any time after the link has been established.  The commands for configuring CHAP on R1 are the following:

How to Configure Challenge Handshake Authentication Protocol (CHAP) 1

Router R-1 (Local)

Router>enable

Router#config terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname R1

R1(config)#username R2 password Cisco

R1(config)# interface serial0/0/0

R1(config-if)#no shut

R1(config-if)# ip address 192.168.10.1 255.255.255.252

R1(config-if)# ipv6 address 2001:AD01:BD00::1/64

R1(config-if)# clock rate 64000

R1(config-if)#encapsulation PPP

R1(config-if)#ppp authentication chap

R1(config-if)#exit

Router R-2 (Remote)

Router>enable

Router#config terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname R2

R2(config)#username R2 password ccna12345

R2(config)# interface serial0/0/0

R2(config-if)#no shut

R2(config-if)# ip address 192.168.10.2 255.255.255.252

R2(config-if)# ipv6 address 2001:AD01:BD00::2/64

R2(config-if)# clock rate 64000

R2(config-if)#encapsulation PPP

R2(config-if)#ppp authentication chap

R2(config-if)#exit

Picture1

Password Authentication Protocol (PAP)

, , , , , , 5 Comments

PPP support different option that can be configured optionally.  One of these options is authentication.  The authentication option provides a method to negotiate the use of a particular protocol for Authentication. By default, authentication is not required. Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP) can be used for PPP links authentication which is defined in RFC 1334

Password Authentication Protocol is a basic two-way process used to authenticate a user’s password. The username and password are sent in plain text without any encryption. If it is accepted, the connection is allowed. As an authentication protocol, PAP is the least secure because the password is sent in plain text.

The figure below illustrates the process of PAP.  R1 sends its PAP user name and password to R2. R2 evaluate R1’s user name and password against its local database. If it matches, it accepts the connection and accepts the message. If not, it rejects the connection and sends a reject message.

PAP

The command “ppp authentication pap” is used for PPP authentication. When the command is entered, the username and password are sent as one LCP data packet. After PPP completes the link establishment phase, the remote node constantly sends a username with password across the link until the receiving node acknowledges the connection or terminates the connection.

The receiving node checked the username-password using an authentication server that either allows or denies the connection. If the connection is accepted, it sends the connection acknowledgement message otherwise it returned the reject message. Password Authentication Protocol authenticates only during establishing a connection, it never re-authenticate after connection establishment. This is a network vulnerability to the attacker; they can attack using this area.

Password Authentication Protocol can be used where a large installed base of client applications that do not support CHAP.  Password Authentication Protocol can also be important between different vendor equipment, where implementations of CHAP are not compatible. It is also used where a plaintext password is necessary to simulate a login at the remote host

Configuring PAP Authentication

Now we know the basic information about PAP. We know that PAP is a two-way authentication protocol. Both routers authenticate and are authenticated. The PAP username and password that each router sends must match those configured with the username name password password command of the other router.

PAP only did authentication during initial link establishment. The hostname on one router must match the username the other router has configured for PPP. The passwords must also match. Specify the username and password parameters, The PAP configuration for the above topology is the following:-

Router R-1 (Remote Site)

Router>enable

Router#config terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname R1

R1(config)#username R2 password ccna12345

R1(config)# interface serial0/0/0

R1(config-if)#no shut

R1(config-if)# ip address 192.168.10.1 255.255.255.252

R1(config-if)# ipv6 address 2001:AD01:BD00::1/64

R1(config-if)# clock rate 64000

R1(config-if)#encapsulation PPP

R1(config-if)#ppp authentication pap

R1(config-if)#exit

Router R-2 (Central Site)

Router>enable

Router#config terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname R2

R2(config)#username R2 password ccna12345

R2(config)# interface serial0/0/0

R2(config-if)#no shut

R2(config-if)# ip address 192.168.10.2 255.255.255.252

R2(config-if)# ipv6 address 2001:AD01:BD00::2/64

R2(config-if)# clock rate 64000

R2(config-if)#encapsulation PPP

R2(config-if)#ppp authentication pap

R2(config-if)#exit

1 2 3 4 ›»