Reference Guide for the Model RT210/RT211 ISDN Routers
1-8 Introduction
Password Authentication Protocol
The Password Authentication Protocol (PAP) is the simplest method of enabling security on PPP
links. When the link is being set up, the Peer (caller) sends its Name and Password to the
Authenticator. If the Name and Password match the values stored by the Authenticator, the
connection is allowed to proceed.
Challenge Handshake Authentication Protocol
The Challenge Handshake Authentication Protocol (CHAP) is a more complex method of security.
The Authenticator challenges the Peer, which responds with the output of an algorithm based on
the CHAP Secret and the CHAP Name (the Name of the Path).
The Authenticator verifies the output by using its CHAP Secret configured on the path CHAP
Name as the key for the algorithm. The Authenticator checks that the output value it calculates is
the same as the one received from the Peer. If the challenge is responded to correctly, the
connection is allowed to proceed. Because the CHAP Secret itself is never sent across the link, it
cannot be discovered by anyone monitoring the line.
Defining Security Levels
Because ISDN is a public service, it opens your network to unauthorized access and security
becomes an important issue. The NETGEAR Model RT210 and Model RT211 ISDN routers are
equipped with the following features designed to maintain security:
• Caller Line Identification (CLI or Caller ID) ensures that incoming ISDN calling numbers are
checked before access is granted.
• When PPP is the link protocol for connecting to third-party routers, you can use either
Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol
(CHAP).
— PAP improves security by requesting that a password be sent by the caller.
— CHAP, a more complex method of security, checks the authenticity of the password
without sending it across the link.
NGRRT210.BK Page 8 Friday, October 17, 1997 2:37 PM