Link control comes before network control
PPP carries network-layer packets across a point-to-point link. Link Control Protocol (LCP) establishes the link and negotiates options such as maximum receive unit and authentication. After the link opens and any required authentication succeeds, Network Control Protocols (NCPs) negotiate settings for individual network protocols. IPCP is the NCP for IPv4.
LCP being open does not mean IPv4 is ready. When diagnosing a PPP link, check establishment, any authentication, and the NCP for the traffic you need in that order.
PAP and CHAP authentication
Password Authentication Protocol (PAP) sends a peer ID and password in the authentication request. The peer replies with acceptance or rejection. PAP itself does not hide the password on the link.
With Challenge-Handshake Authentication Protocol (CHAP), the authenticator sends a challenge. The peer returns a value computed from the challenge and a shared secret, and the authenticator checks the response. The secret itself does not travel in the response. CHAP authenticates a peer but does not encrypt its data traffic.
Try it in a lab
- Bring up a PPP link between two lab peers. In a trace, identify the LCP exchange, any authentication phase, and IPCP before the first IPv4 data packet.
- With CHAP enabled, use a mismatched test secret on one peer. Verify that the challenge receives a response but authentication fails and IPv4 does not open. Restore the lab secret and confirm IPCP opens.