MS-CHAP differs from the standard CHAP as follows:

• MS-CHAP is enabled by negotiating CHAP Algorithm 0x80 in LCP option 3, Authentication Protocol.

• The MS-CHAP Response packet is in a format designed to be compatible with Microsoft Windows NT 3.5 and 3.51, Microsoft Windows 95, and Microsoft LAN Manager 2.x. This format does not require the authenticator to store a clear or reversibly encrypted password.

• MS-CHAP provides an authenticator-controlled authentication retry mechanism.

• MS-CHAP provides an authenticator-controlled change password mechanism.

• MS-CHAP defines a set a "reason-for failure" codes returned in the Failure packet message field.

• Cisco 2500 series

• Cisco 3600 series

• Cisco 4000 series (Cisco 4000, 4000-M, 4500, 4500-M, 4700, 4700-M)

• Cisco AS5200 series

• Cisco 7000 series

• Cisco 7200 series

• Cisco 7500 series

1 ) Enable AAA by using the aaa new-model global configuration command. For more information about enabling AAA, refer to the "AAA Overview" chapter in the Cisco IOS Release 11.3 Security Configuration Guide.

2 ) Configure security protocol parameters, such as RADIUS or TACACS+. For more information about configuring RADIUS, refer to the "Configuring RADIUS" chapter in the Cisco IOS Release 11.3 Security Configuration Guide. For more information about configuring TACACS+, refer to the "Configuring TACACS+" chapter in the Cisco IOS 11.3 Security Configuration Guide.

3 ) Define the method lists for authentication by using the aaa authentication command. For more information about defining authentication method lists or configuring other authentication parameters, refer to the "Configuring Authentication" chapter in the Cisco IOS Release 11.3 Security Configuration Guide.

4 ) Apply the method lists to a particular line or interface, if required. For more information about applying authentication method lists, refer to the "Configuring Authentication" chapter in the Cisco IOS Release 11.3 Security Configuration Guide.

5 ) (Optional) Configure authorization using the aaa authorization command. For more information about configuring authorization parameters, refer to the "Configuring Authorization" chapter in the Cisco IOS Release 11.3 Security Configuration Guide.

6 ) (Optional) Configure accounting using the aaa accounting command. For more information about configuring accounting parameters, refer to the "Configuring Accounting" chapter in the Cisco IOS Release 11.3 Security Configuration Guide.

For detailed information about any of the commands listed above, refer to the Cisco IOS Release 11.3 Security Command Reference.

If you configure ppp authentication ms-chap on an interface, all incoming calls on that interface that initiate a PPP connection will have to be authenticated using MS-CHAP. If you configure the ppp authentication command with the callin keyword, the access server will only authenticate the remote device if the remote device initiated the call.

Authentication method lists and the one-time keyword are only available if you have enabled AAA--they will not be available if you are using TACACS or Extended TACACS. If you specify the name of an authentication method list with the ppp authentication command, PPP will attempt to authenticate the connection using the methods defined in the specified method list. If AAA is enabled and no method list is defined by name, PPP will attempt to authenticate the connection using the methods defined as the default. The ppp authentication command with the one-time keyword enables support for one-time passwords during authentication.

The if-needed keyword is only available if you are using TACACS or Extended TACACS. The ppp authentication command with the if-needed keyword means that PPP will only authenticate the remote device via MS-CHAP if that device has not yet authenticated during the life of the current call. If the remote device authenticated through a standard login procedure and initiated PPP from the EXEC prompt, PPP will not authenticate through MS-CHAP if ppp authentication chap if-needed is configured.

aaa new-model
aaa authentication login admins local
aaa authentication ppp dialins radius local
aaa authorization network radius local
aaa accounting network start-stop radius
username root password ALongPassword
radius-server host alcatraz
radius-server key myRaDiUSpassWoRd
interface group-async 1
 group-range 1 16
 encapsulation ppp
 ppp authentication ms-chap dialins
line 1 16
 autoselect ppp
 autoselect during-login
 login authentication admins
 modem dialin

The lines in this sample RADIUS AAA configuration are defined as follows:

• The aaa new-model command enables AAA network security services.

• The aaa authentication login admins local command defines another method list, "admins," for login authentication.

• The aaa authentication ppp dialins radius local command defines the authentication method list "dialins," which specifies that RADIUS authentication then (if the RADIUS server does not respond) local authentication will be used on serial lines using PPP.

• The aaa authorization network radius local command is used to assign an address and other network parameters to the RADIUS user.

• The aaa accounting network start-stop radius command tracks PPP usage.

• The username command defines the username and password to be used for the PPP Password Authentication Protocol (PAP) caller identification.

• The radius-server host command defines the name of the RADIUS server host.

• The radius-server key command defines the shared secret text string between the network access server and the RADIUS server host.

• The interface group-async command selects and defines an asynchronous interface group.

• The group-range command defines the member asynchronous interfaces in the interface group.

• The encapsulation ppp command sets PPP as the encapsulation method used on the specified interfaces.

• The ppp authentication ms-chap dialins command selects MS-CHAP as the method of PPP authentication and applies the "dialins" method list to the specified interfaces.

• The line command switches the configuration mode from global configuration to line configuration and identifies the specific lines being configured.

• The autoselect ppp command configures the Cisco IOS software to allow a PPP session to start up automatically on these selected lines.

• The autoselect during-login command is used to display the username and password prompt without pressing the Return key. After the user logs in, the autoselect function (in this case, PPP) begins.

• The login authentication admins command applies the "admins" method list for login authentication.

• The modem dialin command configures modems attached to the selected lines to only accept incoming calls.