topic Re: PAP Authentication Protocol in Network Access Control

PAP Authentication Protocol

clark white — Mon, 11 Mar 2019 07:00:00 GMT

Dears,

when I do ssh to switches the authentication protocol and in authentication details in the attached snapshot I see the protocol as a PAP_ASCII which is been used.

As I know the PAP is clear text password authentication protocol, so how I can justify to anybody the connection to my switch is secure.

Enabling PAP as an

Jatin Katyal — Tue, 16 Aug 2016 16:45:25 GMT

Enabling PAP as an authentication protocol with Radius+ means that user passwords are sent from a client to a NAS in plaintext form. The NAS ( switch / Router / WLC / ASA etc) encrypts the user's password using the shared secret and sends it in an Access-Request packet.

RADIUS encrypts only the password in the access-request packet, from the client to the server. The remainder of the packet is unencrypted. Other information, such as username, authorized services, and accounting, can be captured by a third party 🙂

...so yes it's less secure when we compare against TACACS because TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header.

https://technet.microsoft.com/en-us/library/cc958013.aspx

Rgds,

Jatin

~ Do rate helpful posts.

Dear Jatin,

clark white — Tue, 16 Aug 2016 19:53:32 GMT

Dear Jatin,

thanks for the reply, In such situation how I can avoid PAP, whenever I do ssh or telnet the connection details shows me PAP_ASCII protocol if I don't allow PAP the connection will not be established.??

thanks

So the only way to access the

Jatin Katyal — Tue, 16 Aug 2016 20:05:27 GMT

So the only way to access the managed device securely is to use SSH and avoid TELNET. from NAS to AAA server ( Radius), your password is anyway encrypted.

You may want to read the detailed discussion here:

https://supportforums.cisco.com/discussion/12668396/does-cisco-support-strong-remote-network-authentication-protocols

Rgds,

Jatin

~ Do rate helpful posts.

+5 to you expert

clark white — Tue, 16 Aug 2016 20:24:22 GMT

+5 to you expert

Re: PAP Authentication Protocol

jeremytetart — Tue, 27 Aug 2019 15:52:58 GMT

Hi Clark,

I added a comment on this post about your question => https://community.cisco.com/t5/routing/does-cisco-support-strong-remote-network-authentication/m-p/2767297/highlight/false#M257295

I think I reply to your answer.

Regards.

Re: PAP Authentication Protocol

pafcio84 — Mon, 16 Jun 2025 13:16:59 GMT

Hi As I understood. PAP_ASCII is plain text but when you use from your laptop SSH then all traffic is encrytped and PAP_ASCII not used. Then between NAS and ISE PAP ASCII is running and it's encrypted by TACACS+.