Skip to main content

7.2 Framed User Authenticating with CHAP

7.2. Framed User Authenticating with CHAP

The NAS at 192.168.1.16 sends an Access-Request UDP packet to the RADIUS Server for a user named flopsy logging in on port 20 with PPP, authenticating using CHAP. The NAS sends along the Service-Type and Framed-Protocol attributes as a hint to the RADIUS server that this user is looking for PPP, although the NAS is not required to do so.

The Request Authenticator is a 16 octet random number generated by the NAS, and is also used as the CHAP Challenge.

The CHAP-Password consists of a 1 octet CHAP ID, in this case 22, followed by the 16 octet CHAP response.

  01 01 00 47 2a ee 86 f0 8d 0d 55 96 9c a5 97 8e
  0d 33 67 a2 01 08 66 6c 6f 70 73 79 03 13 16 e9
  75 57 c3 16 18 58 95 f2 93 ff 63 44 07 72 75 04
  06 c0 a8 01 10 05 06 00 00 00 14 06 06 00 00 00
  02 07 06 00 00 00 01

   1 Code = 1     (Access-Request)
   1 ID = 1
   2 Length = 71
  16 Request Authenticator

  Attributes:
   8  User-Name (1) = "flopsy"
  19  CHAP-Password (3)
   6  NAS-IP-Address (4) = 192.168.1.16
   6  NAS-Port (5) = 20
   6  Service-Type (6) = Framed (2)
   6  Framed-Protocol (7) = PPP (1)

The RADIUS server authenticates flopsy, and sends an Access-Accept UDP packet to the NAS telling it to start PPP service and assign an address for the user out of its dynamic address pool.

The Response Authenticator is a 16-octet MD5 checksum of the code (2), id (1), Length (56), the Request Authenticator from above, the attributes in this reply, and the shared secret.

  02 01 00 38 15 ef bc 7d ab 26 cf a3 dc 34 d9 c0
  3c 86 01 a4 06 06 00 00 00 02 07 06 00 00 00 01
  08 06 ff ff ff fe 0a 06 00 00 00 02 0d 06 00 00
  00 01 0c 06 00 00 05 dc

   1 Code = Access-Accept (2)
   1 ID = 1 (same as in Access-Request)
   2 Length = 56
  16 Response Authenticator

  Attributes:
   6  Service-Type (6) = Framed (2)
   6  Framed-Protocol (7) = PPP (1)
   6  Framed-IP-Address (8) = 255.255.255.254
   6  Framed-Routing (10) = None (0)
   6  Framed-Compression (13) = VJ TCP/IP Header Compression (1)
   6  Framed-MTU (12) = 1500
Last updated on