HP MSR SERIES User Manual

367
Item Descri
p
tion
Mandatory CHAP
Configure user authentication on an LNS.
You can configure an LNS to authenticate a user who has passed
authentication on the LAC to increase security. In this case, an
L2TP tunnel can be set up only when both of the authentications
succeed. An LNS can authenticate users the following ways:
• Mandatory CHAP authentication—A VPN user who depends
on a NAS to initiate tunneling requests is authenticated twice,
once when accessing the NAS and once on the LNS by using
CHAP.
• LCP re-negotiation—A PPP user who depends on a NAS to
initiate tunneling requests first performs PPP negotiation with
the NAS. If the negotiation succeeds, the NAS initiates an L2TP
tunneling request and sends the user authentication information
to the LNS. The LNS then determines whether the user is valid
according to the user authentication information received.
Under some circumstances (when authentication and
accounting are required on the LNS for example), another
round of LCP negotiation is required between the LNS and the
user. In this case, the user authentication information from the
NAS will be neglected.
• Proxy authentication—If neither LCP re-negotiation nor
mandatory CHAP authentication is configured, an LNS
performs proxy authentication of users. In this case, the LAC
sends to the LNS all authentication information from users and
the authentication mode configured on the LAC itself.
IMPORTANT:
• Among these three authentication methods, LCP re-negotiation
has the highest priority. If both LCP re-negotiation and
mandatory CHAP authentication are configured, the LNS uses
LCP re-negotiation and the PPP authentication method
configured in the L2TP group.
• With LCP re-negotiation, if no PPP authentication method is
configured in the L2TP group, the LNS will not re-authenticate
users. It will assign public addresses to the PPP users
immediately. In other words, the users are authenticated only
once at the LAC end.
• Some PPP clients might not support re-authentication, in which
case LNS side CHAP authentication will fail.
• When the LNS uses proxy authentication and the user
authentication information received from the LAC is valid, if the
authentication method configured in the L2TP group is PAP, the
proxy authentication succeeds and a session can be
established for the user. If the authentication method configured
in the L2TP group is CHAP but that configured on the LAC is
PAP, the proxy authentication fails and no session can be set
up. This is because the level of CHAP authentication, which is
required by the LNS, is higher than that of PAP authentication,
which the LAC provides.
Mandatory LCP

HP MSR SERIES Specifications

General

Product Series	MSR Series
Manufacturer	HP
Category	Network Router
Ports	Varies by model
WAN Interfaces	Varies by model
LAN Interfaces	Varies by model
VPN Support	Yes
Firewall	Yes
Dimensions	Varies by model
Weight	Varies by model
Wireless Support	Varies by model
Management	Web-based, CLI
Power Supply	Varies by model
Operating Temperature	0°C to 45°C
Storage Temperature	-40°C to 70°C
Humidity	5% to 95% non-condensing