Concepts

This chapter contains information on the following topics:

IP routing protocols
Point-to-Point Protocol (PPP) authentication protocols

Selecting IP Routing Protocols

The Cisco 800 series routers support the following IP routing protocols:

Routing Information Protocol (RIP)
Enhanced Interior Gateway Routing Protocol (EIGRP)

Table A-1 summarizes the characteristics of RIP and EIGRP. The following sections contain more details on RIP and EIGRP.

Table A-1: RIP and EIGRP Comparison

IP Routing Protocol Ideal Topology Metric Routing Updates

RIP

Suited for topologies with 15 or fewer hops to reach a destination.

Hop count; maximum hop count is 15. Best route is one with lowest hop count.

By default, every 30 seconds. You can reconfigure this value and also use triggered extensions to RIP.

EIGRP

Suited for large topologies with 16 or more hops to reach a destination.

Distance information. Based on a successor, which is a neighboring router that has a least-cost path to a destination that is guaranteed to not be part of a routing loop.

Hello packets sent every 5 seconds plus incremental updates sent when the state of a destination changes.

IP Routing Protocol	Ideal Topology	Metric	Routing Updates
RIP	Suited for topologies with 15 or fewer hops to reach a destination.	Hop count; maximum hop count is 15. Best route is one with lowest hop count.	By default, every 30 seconds. You can reconfigure this value and also use triggered extensions to RIP.
EIGRP	Suited for large topologies with 16 or more hops to reach a destination.	Distance information. Based on a successor, which is a neighboring router that has a least-cost path to a destination that is guaranteed to not be part of a routing loop.	Hello packets sent every 5 seconds plus incremental updates sent when the state of a destination changes.

Routing Information Protocol

RFC 1058 is the specification for RIP.

RIP is a distance-vector routing protocol, which means that it uses distance (hop count) as its metric for route selection. Hop count is the number of routers that a packet must traverse to reach its destination. For example, if a particular route has a hop count of 2, then a packet must traverse two routers to reach its destination. RIP selects routes based on the lowest hop count. For example, if two routes to the same destination exist and one route has 3 hops associated with it and the other has 2 hops, RIP selects the route with 2 hops. In the case that multiple routes have the same hop count, RIP will select one route then the other route in a round-robin fashion. According to RIP, the maximum allowable hop count is 15.

By default, RIP routing updates are broadcast every 30 seconds. You can reconfigure the interval at which the routing updates are broadcast. You can also configure triggered extensions to RIP so that routing updates are sent only when the routing data base is updated. For more information on triggered extensions to RIP, refer to the Cisco IOS 12.0(1)T documentation set. For information on accessing the documentation, see the "References to Cisco IOS Documentation Set" in "About This Guide."

RIP supports load balancing. You can evenly distribute traffic among multiple routes to the same destination and that have the same metric. By default, the RIP routing table includes up to four equal routes.

Enhanced Interior Gateway Routing Protocol

EIGRP is an advanced Cisco-proprietary distance-vector routing protocol, which means it uses a metric more sophisticated than distance (hop count) for route selection. EIGRP uses a metric based on a successor, which is a neighboring router that has a least-cost path to a destination that is guaranteed to not be part of a routing loop. If a successor for a particular destination does not exist but neighbors advertise the destination, the router must recompute a route.

Each router running EIGRP sends hello packets every 5 seconds to let neighboring routers know it is functioning. If a particular router does not send a hello packet within a prescribed period, EIGRP assumes that the state of a destination has changed and sends an incremental update.

Because EIGRP supports IP and IPX, you can use one routing protocol for multiprotocol network environments, minimizing the size of the routing tables and the amount of routing information.

Selecting PPP Authentication Protocol

The Cisco 800 series routers support two PPP authentication protocols:

Password Authentication Protocol (PAP)
Challenge Handshake Authentication Protocol (CHAP)

Table A-2 summarizes the characteristics of PAP and CHAP so that you can decide which protocol you want to use. The following sections contain more details on PAP and CHAP.

Note Cisco recommends using CHAP because it is more secure.

Table A-2: PAP and CHAP Comparison

Authentication Protocol Controls Authentication Attempt(s) Handshake Method Password Protection from Playback or Repeated Attacks?

PAP

Remote office router (remote node)

Two-way. Remote office router sends username/password pair until corporate office router accepts.

Uses clear text password.

No.

CHAP

Corporate office router (local node)

Three-way. Corporate office router sends challenge to remote office router. Remote office router responds. Corporate office router accepts or rejects authentication.

Uses variable, unique, and unpredictable challenge value.

Yes, through the challenge variable and repeated challenges after the link has been established.

Authentication Protocol	Controls Authentication Attempt(s)	Handshake Method	Password	Protection from Playback or Repeated Attacks?
PAP	Remote office router (remote node)	Two-way. Remote office router sends username/password pair until corporate office router accepts.	Uses clear text password.	No.
CHAP	Corporate office router (local node)	Three-way. Corporate office router sends challenge to remote office router. Remote office router responds. Corporate office router accepts or rejects authentication.	Uses variable, unique, and unpredictable challenge value.	Yes, through the challenge variable and repeated challenges after the link has been established.

PAP

To illustrate how PAP works, imagine a network topology where a remote office router (Cisco 800 series router) is connected to a corporate office router (such as a Cisco 3600 router). After the PPP link establishment phase is complete, the remote office router repeatedly sends a configured username and password until the corporate office router accepts the authentication.

PAP has the following characteristics:

The password portion of the authentication is sent across the link in clear text (not scrambled or encrypted).
PAP provides no protection from playback or repeated trial-and-error attacks.
The remote office router controls the frequency and timing of the authentication attempts.

CHAP

To illustrate how CHAP works, imagine a network topology where a remote office router (Cisco 800 series router) is connected to a corporate office router (such as a Cisco 3600 router). After the PPP link establishment phase is complete, the corporate office router sends a challenge message to the remote office router. The remote office router responds with a variable value. The corporate office router checks the response against its own calculation of the value. If the values match, the corporate office router accepts the authentication. The authentication process can be repeated any time after the link is established.

CHAP has the following characteristics:

The authentication process uses a variable challenge value rather than a password.
CHAP provides protection against playback attack through the use of the variable challenge value, which is unique and unpredictable. Repeated challenges limit the time of exposure to any single attack.
The corporate office router controls the frequency and timing of the authentication attempts.

Table of Contents

Concepts

Concepts

Selecting IP Routing Protocols

Routing Information Protocol

Enhanced Interior Gateway Routing Protocol

Selecting PPP Authentication Protocol

PAP

CHAP