PAP Authentication Protocol

[clark white]

Dears,

when I do ssh  to switches the authentication protocol and in authentication details in the attached snapshot I see the protocol as a PAP_ASCII which is been used.

As I know the PAP is clear text password authentication protocol, so how I can justify to anybody the connection to my switch is secure.

[Jatin Katyal]

Enabling PAP as an authentication protocol with Radius+ means that user passwords are sent from a client to a NAS in plaintext form. The NAS ( switch / Router / WLC / ASA etc) encrypts the user's password using the shared secret and sends it in an Access-Request packet.

RADIUS encrypts only the password in the access-request packet, from the client to the server. The remainder of the packet is unencrypted. Other information, such as username, authorized services, and accounting, can be captured by a third party :)

...so yes it's less secure when we compare against TACACS because TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header.

https://technet.microsoft.com/en-us/library/cc958013.aspx

Rgds,

Jatin

~ Do rate helpful posts.

[clark white]

Dear Jatin,

thanks for the reply, In such situation how I can avoid PAP, whenever I do ssh or telnet the connection details shows me PAP_ASCII protocol if I don't allow PAP the connection will not be established.??

thanks

[Jatin Katyal · Accepted solution]

So the only way to access the managed device securely is to use SSH and avoid TELNET. from NAS to AAA server ( Radius), your password is anyway encrypted.

You may want to read the detailed discussion here:

https://supportforums.cisco.com/discussion/12668396/does-cisco-support-strong-remote-network-authentication-protocols

Rgds,

Jatin

~ Do rate helpful posts.

[clark white]

+5 to you expert

[jeremytetart]

Hi Clark,

I added a comment on this post about your question => https://community.cisco.com/t5/routing/does-cisco-support-strong-remote-network-authentication/m-p/2767297/highlight/false#M257295

I think I reply to your answer.

Regards.