Security in PPP can be further augmented with the use of PPP callback, which instructs
the access server to disconnect the incoming connection after successful authentication and
re-establish the connection via an outbound call. This security feature requires that the
caller be in a single physical location and diminishes the impact of a compromised username
and password. The service can also be used to control costs because all connections appear
to be from the remote access server—allowing volume-based discounts.
PPP callback is documented in RFC 1570.
Clearly, this solution is not well suited to mobile users; for example, callback to a hotel room
would require repeated configuration and a mechanism to deal with extensions. Some callback
solutions enable the remote user to enter the callback number—a solution that removes the
physical location restrictions and enhances mobility.
Cisco’s callback feature does not permit remote users to dynamically enter the
callback number.
Consider the security provided by a callback configuration:
The remote client (user) must connect into the remote access server.
By using an authentication protocol such as CHAP, the user must authenticate.
If authentication is successful, the session will terminate and the remote access server will
call the remote client back. If the authentication fails, the connection will terminate.
Upon callback, the client and server can again perform password verification.
Clearly, these extra steps could enhance security.
To configure callback, the administrator needs to use the ppp callback accept command
on the router interface that receives the initial inbound call and the ppp callback request
command on the interface that is making the initial outbound call.
PPP callback will not make repeated retries to establish a return connection.
This means that a busy signal or other impediment will require the client side
to re-request the session.