Configuring the CHAP Secret for an L2TP Profile
CHAP allows each end of a PPP link to authenticate its peer, as defined in RFC 1994. The authenticator sends its peer a randomly generated challenge that the peer must encrypt using a one-way hash; the peer must then respond with that encrypted result. The key to the hash is a secret known only to the authenticator and authenticated. When the response is received, the authenticator compares its calculated result with the peer’s response. If they match, the peer is authenticated.
Each end of the link identifies itself to its peer by including its name in the CHAP challenge and response packets it sends to the peer. This name defaults to the local hostname, or you can explicitly set it using the local-name option. When a host receives a CHAP challenge or CHAP response packet on a particular interface, it uses the peer identity to look up the CHAP secret key to use.
 | Note: When you configure PPP properties for a Layer 2 Tunneling Protocol (L2TP) profile, you typically configure the chap-secret statement or pap-password statement. |
To configure CHAP, include the profile statement and specify a profile name at the [edit access] hierarchy level:
Then reference the CHAP profile name at the [edit interfaces interface-name ppp-options chap] hierarchy level.
You can configure multiple profiles. You can also configure multiple clients for each profile.
profile is the mapping between peer identifiers and CHAP secret keys. The identity of the peer contained in the CHAP challenge or response queries the profile for the secret key to use.
client is the peer identity.
chap-secret secret is the secret key associated with that peer.
