PPP PAP Authentication: One-Way Config Causes Link Failure

PPP (Point-to-Point Protocol) requires mutual authentication—both ends of the serial link must authenticate each other for the link to establish (LCP open state).

PAP (Password Authentication Protocol) sends credentials in cleartext (2-way handshake: Authenticate-Request → Authenticate-Ack/Nak). If PAP is configured on only one end:

• The configuring side sends Authenticate-Request.
• The peer side, lacking PAP configuration, cannot process it—treats as unknown protocol or ignores.
• No Authenticate-Ack is returned.
• Authentication fails → LCP closes → link goes down.

Solution

• Configure PAP (or preferably CHAP/EAP) on both routers.
• Ensure matching usernames/passwords.
• Verify with debug ppp authentication and show interface.

CHAP (Challenge-Handshake Authentication Protocol) is preferred—uses 3-way handshake with hashed challenge, periodic re-authentication, no cleartext passwords.