Hi John,
Hmmm... I am sorry but I still do not agree with your reasoning.
the 2 lines which i provided are required for PAP to work.
This depends on the direction of the authentication. I maintain that these two lines are not required if Dale's router should authenticate to the ISP and not vice versa. The ppp authentication pap command will request that the other party authenticates to us. It does not influence whether we agree on a particular type of authentication requested from the other party. If we wanted to refuse a particular authentication type we would use the ppp pap refuse or ppp chap refuse commands, but it is always the other party that requires authentication from us.
Quoting from the IOS Security Command Reference for 12.4T at
http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_p2.html#wp1032515
When you enable Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), or Extensible Authentication Protocol (EAP) authentication (or all three methods), the local router requires the remote device to prove its identity before allowing data traffic to flow.
In other words, using the plain ppp authentication pap on Dale's router would cause Dale's router to send PPP PAP Request to the ISP, and Dale's router would expect a PAP Response from ISP, then compare the received username and password to the local username database. Is this what we want - to authenticate the ISP to us? Surely not! The authentication should go the other way around!
Let me also quote the Linux manpage about pppd that puts it quite nicely:
The PPP protocol, being symmetrical, allows both peers to require the
other to authenticate itself. In that case, two separate and indepen‐
dent authentication exchanges will occur. The two exchanges could use
different authentication protocols, and in principle, different names
could be used in the two exchanges.
So, if I request authentication from the other party, it has absolutely no effect whether I will have to authenticate myself to the other party as well, and what kind of authentication that will be.
The configuration as used and suggested by you works because, just by a happy coincidence, a DSL connection is not treated as incoming PPP call, and thus the command ppp authentication pap callin actually has no effect - as if you never entered it at all. I am very sure that if you removed the callin keyword, your clients would not be able to connect as they would request PAP authentication from the ISP's access concentrators. That would require setting up local username databases on your clients' routers so that the username/password of the ISP access concentrators could be verified against it.
Best regards,
Peter
