User`s guide

Setting Up Pipeline Security
Using security cards
7-20 Preliminary January 30, 1998 Pipeline User’s Guide
Requesting PAP-TOKEN-CHAP mode
PAP-TOKEN-CHAP authenticates additional channels using CHAP. If it is
specified in the Send Auth parameter, but the RADIUS profile at the far end is
not set up for PAP-TOKEN-CHAP, then PAP-TOKEN is used instead.
The dynamic password supplied by a user authenticates the base channel of the
call. It is sent in the clear (via PAP). When the Pipeline adds additional channels
to the call, PAP-TOKEN-CHAP uses CHAP authentication for the new channels.
CHAP sends encrypted passwords, so it can take the auxiliary password from the
Aux Send PW parameter and transmit it securely.
The following parameters are used to configure the calling unit:
Ethernet
Connections
profile
Encaps options...
Send Auth=PAP-TOKEN-CHAP
Send PW=*SECURE*
Aux Send PW=*SECURE*
The Send Auth parameter specifies the authentication mode requested by the
calling unit (PAP-TOKEN-CHAP in this case). The Send PW password is sent as
part of the initial session negotiation. If the session presents a password
challenge, the user enters the password generated by the security card.
The Aux Send PW parameter is sent via CHAP for authenticating additional
channels; additional entries derived from the security card are not required.
Requesting CACHE-TOKEN
CACHE-TOKEN uses CHAP and caches the initial password for re-use in
authenticating channels as they are added to the call. The RADIUS profile at the
far end must be set up with appropriate attributes that specify how long the token
will be cached.
The following parameters are used to configure the calling unit: