CISCO CCNA BOOTCAMP

PPP
(Point to Point Protocol)
 Serial Communication Standards
 In a serial communication process.
–Data is encapsulated by the sending router.
–The frame is sent on a physical medium to the WAN.
–There are various ways to traverse the WAN,
–The receiving router uses the same communications
protocol to de-encapsulate the frame when it arrives.
 There are three key serial communication standards
affecting LAN-to-WAN connections:
–RS-232 - Most serial ports on personal computers conform
to the RS-232C standards.
•Both 9-pin and 25-pin connectors are used.
•It be used for device, including modems, mice, and printers.
–V.35 – It is used for modem-to-multiplexer communication.
•V.35 is used by routers and DSUs that connect to T1 carriers.
–HSSI - A High-Speed Serial Interface (HSSI) supports
transmission rates up to 52 Mb/s.
•HSSI is used to connect routers on LANs with WANs over high-
speed lines such as T3 lines.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 2
 T-Carrier Hierarchy
 DS0: The original unit used in multiplexing
telephone calls is 64 kb/s, which represents one
phone call.
 T1: In North America, 24 DS0 units are
multiplexed using TDM into a higher bit-rate
signal with an aggregate speed of 1.544 Mb/s
for transmission over T1 lines.
–While it is common to refer to a 1.544 Mb/s
transmission as a T1, it is more correct to refer to
it as DS1.
–T-carrier refers to the bundling of DS0s.
–A T1 = 24 DSOs,
–A T1C = 48 DSOs (or 2 T1s), and so on.
 E1: Outside North America, 32 DS0 units are
multiplexed for E1 transmission at 2.048 Mb/s.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 3
 Demarcation Point
 The demarcation point marks the point where your
network interfaces with the network owned by another
organization.
–This is the interface between customer-premises
equipment (CPE) and network service provider equipment.
–The demarcation point is the point in the network where
the responsibility of the service provider ends.
 The example presents an ISDN scenario.
–In the United States, a service provider provides the local
loop into the customer premises,
•The customer provides the active equipment such as the
channel service unit/data service unit (CSU/DSU) on which the
local loop is terminated.
•The customer is responsible for maintaining, replacing, or
repairing the equipment.
–In other countries, the network terminating unit (NTU) is
provided and managed by the service provider.
•The customer connects a CPE device, such as a router or
frame relay access device, to the NTU using a V.35 or RS-232
serial interface.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 4
 DTE and DCE
 In order to be connecting to the WAN, a serial
connection has a DTE device at one end of the
connection and a DCE device at the other end.
–The DTE, which is generally a router.
•The DTE could also be a terminal, computer, printer,
or fax machine.
–The DCE, commonly a modem or CSU/DSU, is
the device used to convert the user data from the
DTE into a form acceptable to the WAN service
provider transmission link.
•This signal is received at the remote DCE, which
decodes the signal back into a sequence of bits.
•The remote DCE then signals this sequence to the
remote DTE.

 The connection between the two DCE devices is

the WAN service provider transmission network.

Cisco Internal T1 CSU/DSU

WIC-1DSU-T1
ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 5
 DTE and DCE
 DTE and DCE Cable Standards
–Originally, the concept of DCEs and DTEs was based on
two types of equipment: terminal equipment that
generated or received data, and communication
equipment that only relayed data.
–We are left with two different types of cables:
•one for connecting a DTE to a DCE,
•another for connecting two DTEs directly to each other.
 The DTE/DCE interface standard defines the following
specifications:
–Mechanical/physical - Number of pins and connector type
–Electrical - Defines voltage levels for 0 and 1
–Functional - Specifies the functions that are performed by
assigning meanings to each of the signaling lines in the interface
–Procedural - Specifies the sequence for transmitting data
 The Serial Cables
–The original RS-232 standard only defined the
connection of DTEs with DCEs, which were modems.
–A null modem is a communication method to directly
connect two DTEs, such as a computer, terminal, or
printer, using a RS-232 serial cable. With a null modem
connection, the transmit (Tx) and receive (Rx) lines are
crosslinked.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 6
 WAN Encapsulation Protocols
 On WAN connection, data is encapsulated into frames
before crossing the WAN link. The protocol depends on the
WAN technology and communicating equipment:
–HDLC - The default encapsulation type on point-to-point
connections, when the link uses two Cisco devices.
–PPP - Provides router-to-router and host-to-network
connections over synchronous and asynchronous circuits.
•PPP works with several network protocols, such as IP and IPX. PPP
also has built-in security mechanisms such as PAP and CHAP.
–Serial Line Internet Protocol (SLIP) - A standard protocol for
point-to-point serial connections using TCP/IP.
•SLIP has been largely displaced by PPP.
–X.25/Link Access Procedure, Balanced (LAPB) - X.25 specifies With SLIP, you have to know
LAPB, a data link layer protocol. the IP address assigned to you
•X.25 is a predecessor to Frame Relay. by your service provider. You
–Frame Relay - Frame Relay eliminates some of the time- also need to know the IP
consuming processes (such as error correction and flow control) address of the remote system
employed in X.25. you will be dialing into. You
–ATM - The cell relay in which devices send multiple service may also need to configure such
types (voice, video, or data) in fixed-length (53-byte) cells. details as MTU (maximum
•Fixed-length cells allow processing to occur in hardware, thereby transmission unit), MRU
reducing transit delays.
(maximum receive unit), etc.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 7
 HDLC Encapsulation
 HDLC is a bit-oriented synchronous data link layer
protocol developed by the International Organization
for Standardization (ISO).
–HDLC was developed from the Synchronous Data Link
Control (SDLC) standard proposed in the 1970s.
–HDLC provides both connection-oriented and
connectionless service.
–HDLC defines a Layer 2 framing structure that allows
for flow control and error control through the use of
acknowledgments.
–HDLC uses a frame delimiter, or flag, to mark the
beginning and the end of each frame.
 Cisco has developed an extension to the HLDC
protocol to solve the inability to provide multiprotocol
support.
–Cisco HLDC (also referred to as cHDLC) is proprietary
–Cisco HDLC frames contain a field for identifying the
network protocol being encapsulated.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 8
 Configuring HDLC Encapsulation
 Cisco HDLC is the default encapsulation method
used by Cisco devices on synchronous serial lines.
–You use Cisco HDLC as a point-to-point protocol on
leased lines between two Cisco devices.
–If the default encapsulation method has been changed,
use the encapsulation hdlc command in privileged mode
to re-enable HDLC.
 If you are connecting to a non-Cisco device, use
synchronous PPP.
 There are two steps to enable HDLC encapsulation:
–Step 1. Enter the interface configuration mode of the
serial interface.
–Step 2. Enter the encapsulation hdlc command to
specify the encapsulation protocol on the interface.
 The output of the show interfaces serial command
displays information specific to serial interfaces.
When HDLC is configured, "Encapsulation HDLC"

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 9
 Troubleshooting a serial interface
 Show ip int brief (sh ip int b)

Router# show ip interface brief

Interface IP-Address OK? Method Status Protocol

Ethernet0 [Link] YES manual up up
Serial0 [Link] YES manual administratively down down

Serial x is down, line protocol is down

Serial x is up, line protocol is down
Serial x is up, line protocol is up (looped)
Serial x is up, line protocol is down (disabled)
Serial x is administratively down, line protocol is down

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 10
 Troubleshooting a serial interface (cont.)
 Five possible problem states can be identified in the
interface status line of the show interfaces serial display:
–Serial x is down, line protocol is down
–Serial x is up, line protocol is down
–Serial x is up, line protocol is up (looped)
–Serial x is up, line protocol is down (disabled)
–Serial x is administratively down, line protocol is down

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 11
 Troubleshooting a serial interface (cont.)
 Five possible problem states can be identified in the
interface status line of the show interfaces serial display:

–Serial x is down, line protocol is down

–Serial x is up, line protocol is down
–Serial x is up, line protocol is up (looped)
–Serial x is up, line protocol is down (disabled)
–Serial x is administratively down, line protocol is down

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 12
 Troubleshooting a Serial Interface
 The show controllers command is
another important diagnostic tool when
troubleshooting serial lines.
 In the figure, serial interface 0/0 has a
V.35 DCE cable attached.
–show controllers serial command.
•If the electrical interface output is shown as
UNKNOWN instead of V.35, EIA/TIA-449, or
some other electrical interface type, the likely
problem is an improperly connected cable.
•If the electrical interface is unknown, the
corresponding display for the show interfaces
serial <x> command shows that the interface
and line protocol are down.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 13
 What is PPP?
 Recall that HDLC is the default serial encapsulation method
when you connect two Cisco routers.
–Cisco HDLC can only work with other Cisco devices.
 However, when you need to connect to a non-Cisco router,
you should use PPP encapsulation.
 PPP includes many features not available in HDLC:
–The link quality management feature monitors the quality of the
link. If too many errors are detected, PPP takes the link down.
–PPP supports PAP and CHAP authentication.
 PPP contains three main components:
–HDLC protocol for encapsulating datagrams over point-to-point
links.
–Extensible Link Control Protocol (LCP) to establish, configure,
and test the data link connection.
–Family of Network Control Protocols (NCPs) for establishing
and configuring different network layer protocols.
•PPP allows the simultaneous use of multiple network layer protocols.
•Some of the more common NCPs are Internet Protocol Control
Protocol, Appletalk Control Protocol, Novell IPX Control Protocol,
Cisco Systems Control Protocol, SNA Control Protocol, and
Compression Control Protocol.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 14
 PPP Layered Architecture
 PPP and OSI share the same physical layer, but PPP
distributes the functions of LCP and NCP differently.
 At the physical layer, you can configure PPP on:
–Asynchronous serial
–Synchronous serial
–HSSI
–ISDN
 PPP does not impose any restrictions regarding
transmission rate other than those imposed by the
particular DTE/DCE interface in use.
 Most of the work done by PPP is at the data link and
network layers by the LCP and NCPs.
–The LCP sets up the PPP connection and its
parameters
–The NCPs handle higher layer protocol configurations,
and the LCP terminates the PPP connection.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 15
 PPP Architecture - Link Control Protocol Layer
 The LCP sits on top of the physical layer and has a
role in establishing, configuring, and testing the data-
link connection.
–The LCP establishes the point-to-point link.
–The LCP also negotiates and sets up control options on
the WAN data link, which are handled by the NCPs.
 The LCP provides automatic configuration of the
interfaces at each end, including:
–Handling varying limits on packet size
–Detecting common misconfiguration errors
–Terminating the link
–Determining when a link is functioning properly or when
it is failing
 PPP also uses the LCP to agree automatically on
encapsulation formats (authentication, compression,
error detection) as soon as the link is established.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 16
 PPP Architecture - Network Control Protocol Layer
 PPP permits multiple network layer protocols to
operate on the same communications link. For
every network layer protocol used, PPP uses a
separate NCP.
–For example, IP uses the IP Control Protocol
(IPCP),
–IPX uses the Novell IPX Control Protocol
(IPXCP).
 NCPs include functional fields containing
standardized codes (PPP protocol field
numbers shown in the figure) to indicate the
network layer protocol that PPP encapsulates.
–Each NCP manages the specific needs required
by its respective network layer protocols.
–The various NCP components encapsulate and
negotiate options for multiple network layer
protocols.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 17
 PPP Configuration Options
 PPP can be configured to support:
–Authentication using either PAP or CHAP
–Compression
–Multilink which combines two or more
channels to increase the WAN bandwidth

 To negotiate the use of these PPP

options, the LCP link-establishment
frames contain Option information in the
Data field of the LCP frame.
 This phase is complete when a
configuration acknowledgment frame
has been sent and received.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 18
 PPP Configuration Options
 PPP may include the following LCP options:
–Authentication - Peer exchange authentication
messages.
•Two choices are Password Authentication Protocol (PAP)
and Challenge Handshake Authentication Protocol (CHAP).
–Compression - Increases the effective throughput on
PPP connections by reducing the amount of data in the
frame that must travel across the link.
•Two compression are Stacker and Predictor.
–Error detection - Identifies fault conditions.
•The Quality and Magic Number options help ensure a
reliable, loop-free data link.
–Multilink - Cisco IOS Release 11.1 and later supports
multilink PPP.
•This alternative provides load balancing over the router
interfaces that PPP uses.
–PPP Callback - To enhance security, Cisco IOS
Release 11.1 and later offers callback over PPP.
•The client makes the initial call, requests that the server
call it back, and terminates its initial call.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 19
 PPP Configuration Commands
 Example 1: Enabling PPP on an Interface
–To set PPP as the encapsulation method used by a serial or ISDN interface,
use the encapsulation ppp interface configuration command.
–R3#configure terminal
–R3(config)#interface serial 0/0
–R3(config-if)#encapsulation ppp
•You must first configure the router with an IP routing protocol to use PPP
encapsulation. If you do not configure PPP on a Cisco router, the default encapsulation
for serial interfaces is HLDC.

 Example 2: Compression
–You can configure point-to-point compression on serial interfaces after you
have enabled PPP. Because this option invokes a software compression
process, it can affect system performance. If the traffic already consists of
compressed files (.zip, .tar, or .mpeg, for example), do not use this option.
–R3(config)#interface serial 0/0
–R3(config-if)#encapsulation ppp
–R3(config-if)#compress [predictor | stac]

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 20
 PPP Configuration Commands
 Example 3: Link Quality Monitoring
–LCP provides an optional link quality determination phase.
–If the link quality percentage is not maintained, the link is deemed to be of poor
quality and is taken down.
–This example configuration monitors the data dropped on the link and avoids
frame looping:
–R3(config)#interface serial 0/0
–R3(config-if)#encapsulation ppp
–R3(config-if)#ppp quality 80
 Example 4: Load Balancing Across Links
–Multilink PPP (also referred to as MP, MPPP, MLP, or Multilink) provides a
method for spreading traffic across multiple physical WAN links while providing
packet fragmentation and reassembly, proper sequencing, multivendor
interoperability, and load balancing on inbound and outbound traffic.
–Router(config)#interface serial 0/0
–Router(config-if)#encapsulation ppp
–Router(config-if)#ppp multilink

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 21
 Verified a Serial PPP Encapsulation Configuration
 Use the show interfaces serial
command to verify proper
configuration of HDLC or PPP
encapsulation.
–When you configure HDLC, the
output of the show interfaces serial
command should show
"encapsulation HDLC".
–When you configure PPP, you can
check its LCP and NCP states.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 22
 PPP Authentication Protocols
 PPP defines an extensible LCP that allows
negotiation of an authentication protocol for
authenticating its peer before allowing network layer
protocols to transmit over the link.
–PAP is a very basic two-way process.
•There is no encryption-the username and password are
sent in plain text. If it is accepted, the connection is allowed.
–CHAP is more secure than PAP. It involves a three-
way exchange of a shared secret.
 The authentication phase of a PPP session is
optional.
–If used, you can authenticate the peer after the LCP
establishes the link.
–If it is used, authentication takes place before the
network layer protocol configuration phase begins.
–The authentication options require that the calling side
of the link enter authentication information. This helps to
ensure that the user has the permission of the network
administrator to make the call.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 23
 Password Authentication Protocol (PAP)
 PPP can performs Layer 2 authentication in
addition to other layers of authentication
–PAP provides method for a remote node to
establish its identity using a two-way handshake.
–the ppp authentication pap command is used,
•the remote node repeatedly sends a username-
password pair across the link until the sending node
acknowledges it or terminates the connection.
–Using PAP, you send passwords across the link
in clear text and there is no protection from
playback or repeated trial-and-error attacks.
 There are times when using PAP is justified.
–Client applications that do not support CHAP
–Incompatibilities between different vendor
implementations of CHAP
–Situations where a plaintext password must be
available to simulate a login at the remote host
ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 24
 Challenge Handshake Authentication Protocol (CHAP)
 Once authentication is established with PAP, it
essentially stops working. This leaves the network
vulnerable to attack.
 CHAP conducts periodic challenges to make sure
that the remote node still has a valid password value.
–The password value is variable and changes
unpredictably while the link exists.
 After the PPP link establishment phase is complete,
–The router sends a challenge to the remote node.
–The remote node responds with a value calculated
using a one-way hash function using MD5.
–The local router checks the response against its own
calculation of the expected hash value. If the values
match, the initiating node acknowledges the
authentication. Otherwise, it immediately terminates the
connection.
–Because the challenge is unique and random, the
resulting hash value is also unique and random.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 25
 PPP Encapsulation and Authentication Process
 Router R1 wishes to establish an PPP CHAP
connection with Router R2.
 Step 1. R1 negotiates the link connection
using LCP with router R2 and the two
systems agree to use CHAP authentication
during the PPP LCP negotiation.
 Step 2. Router R2 generates an ID and a
random number and its username as a
CHAP challenge packet to R1.
 Step 3. R1 will use the username of the
challenger (R2) and cross reference it with
its local database to find its associated
password. R1 will then generate a unique
MD5 hash number using the R2's
username, ID, random number and the
shared secret password.
 Step 4. Router R1 then sends the
challenge ID, the hashed value, and its
username (R1) to R2.
ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 26
 PPP Encapsulation and Authentication Process
 Step 5. R2 generates it own hash value using
the ID, the shared secret password, and the
random number it originally sent to R1.
 Step 6. R2 compares its hash value with the
hash value sent by R1.
–If the values are the same, R2 sends a link
established response to R1.
–If the authentication failed, a CHAP failure
packet is built from the following components:
•04 = CHAP failure message type
•id = copied from the response packet
•"Authentication failure" or some such text
message, which is meant to be a user-
readable explanation
 Note that the shared secret password must be
identical on R1 and R2.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 27
 The ppp authentication Command
 To specify the order in which the CHAP
or PAP protocols are requested on the
interface, use the ppp authentication
interface command.
–You may enable PAP or CHAP or both.
•After you have enabled CHAP or PAP
authentication, or both, the local router
requires the remote device to prove its identity
before allowing data traffic to flow.
•If both methods are enabled, the first method
specified is requested during link negotiation. If
the peer suggests using the second method or
simply refuses the first method, the second
method is tried.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 28
 Configuring PPP with Authentication
 The procedure outlined in the table describes how to
configure PPP encapsulation and PAP/CHAP
authentication protocols.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 29
 Configuring PPP with Authentication
 PAP
–The figure is an example of a two-way PAP
authentication configuration. Both routers authenticate
and are authenticated, so the PAP authentication
commands mirror each other.
•[Tony]: The term “two-way” used here is not the same term
used in “two-way” handshake. This “two-way” here means
R1 challenge R3 and R3 also challenge R1.
–The PAP username and password that each router
sends must match those specified with the username
name password password command of the other router.
 CHAP
–CHAP periodically verifies the identity of the remote
node using a three-way handshake.
•The hostname on one router must match the username the
other router has configured.
•The passwords must also match.
•This occurs on initial link establishment and can be
repeated any time after the link has been established.

The router name and password are exactly the same, because they are case-sensitive
ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 30
 Troubleshooting the serial encapsulation configuration
 The debug ppp authentication command
displays the authentication exchange
sequence.
 Figure illustrates the Left router output
during CHAP authentication with the router
on the right when debug ppp
authentication is enabled. With two-way
authentication configured, each router
authenticates the other. Messages appear
for both the authenticating process and the
process of being authenticated. Use the
debug ppp authentication command to
display the exchange sequence as it occurs.
 Figure highlights router output for a two-
way PAP authentication.
 The debug ppp command is used to display
information about the operation of PPP. The
no form of this command disables
debugging output.
–Router#debug ppp {authentication | packet
| negotiation | error | chap} Router#no
debug ppp {authentication | packet |
negotiation | error | chap}

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 31
 Troubleshooting a PPP Configuration with Authentication
 Authentication is a feature that needs to be implemented
correctly or the security of your serial connection may be
compromised.
–Never assume your authentication configuration works
without testing it.
 Debugging allows you to confirm your configuration and
correct any deficiencies.
–The command is debug ppp authentication.
•Line 1 says that the router is unable to authenticate on
interface Serial0 because the peer did not send a name.
•Line 2 says the router was unable to validate the CHAP
response because USERNAME 'pioneer' was not found.
•Line 3 says no password was found for 'pioneer'.
•In the last line, the code = 4 means a failure has occurred.
Other code values are as follows:
–1 = Challenge
–2 = Response
–3 = Success
–4 = Failure
•id = 3 is the ID number per LCP packet format.
•len = 48 is the packet length without the header.

ITE 1 Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 32
-- End of presentation --

Internetworking 33