Subject: Question on CHAP.

From: Muralidhar Rayapeddi <[email-masked]>
Date: Fri, 14 Jul 2000 20:47:01 +0530

hi,
I have a question on chap authentication to implement in our properitary
stack.
There is an authenticator and I act as the peer. During LCP negotiations
the authenticator
asks for chap which I ack modestly. (I do not request for any auth
during
my lcp request)
Once the lcp negotiations are done, I (peer) expect a challenge to
be received. If I never receive a challenge due to some reason, should I

bring down the link after my restart counter waiting for chap expires or

can I start ipcp immediately though the initial packets might get
dropped
because of authentication not being complete. Please clarify.

Best Regards,
Murali.

---

From: James Carlson <[email-masked]>
Date: Fri, 14 Jul 2000 11:32:13 -0400 (EDT)

> because of authentication not being complete. Please clarify.

If the peer asked for CHAP but refuses to send a CHAP Challenge,
you're free to do anything you like.  Something is broken.  The likely
cause of this, assuming an async link, is that the ACCM negotiated
doesn't actually work (you can test this by putting control characters
into LCP Echo-Request messages).  I would wait a fair amount of time
(a few times the restart timeout) and then kill off LCP with a helpful
error message.

If the peer just launches into IPCP, well, you may as well do that,
too.  He must not have wanted to confirm your identity as much as he
seemed to at first.  This seems unlikely, though.

(Sending IPCP at this point is harmless.  If the peer really does want
CHAP but is delaying the Challenge message, he'll silently ignore the
IPCP messages.  It'll make your implementation look bad on an
analyzer, but it won't hurt the link.)

-- 
James Carlson, Internet Engineering       <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677
"PPP Design and Debugging" --- http://people.ne.mediaone.net/carlson/ppp