SD-WANNetworking SecurityBeginner

HDLC and PPP on Cisco serial links: configuration and troubleshooting

By Mohamed Fayas 8 min readUpdated 15 October 2026

In short: Serial point-to-point links carry frames between two routers. Cisco routers use Cisco HDLC by default, which is simple but proprietary. PPP is the open alternative: LCP sets up the link, NCPs carry each network protocol, and CHAP authenticates the far end without sending the password. Both ends must agree on the encapsulation.

Serial links in a modern world

Serial interfaces carried most WAN traffic before Ethernet services took over. You still meet them in exam labs, older branch routers and some specialist circuits, and the ideas behind them (framing, link negotiation, authentication) live on in protocols such as PPPoE that broadband still uses. This note covers the two encapsulations you will configure: HDLC and PPP. For the bigger WAN picture, see WAN technologies.

A serial link has two roles. The DCE (data circuit-terminating equipment) provides the clock that times each bit; the DTE (data terminal equipment), normally your router, follows it. On a real circuit the provider's modem (CSU/DSU) is the DCE. In a lab with two routers joined back-to-back, the router with the DCE end of the cable must supply the clock itself.

show controllers serial 0/1/0
interface serial 0/1/0
 clock rate 64000

HDLC on Cisco routers

HDLC (high-level data link control) is an ISO standard framing method. The original standard has no field that says which network protocol is inside the frame, so Cisco added a protocol type field. The result, Cisco HDLC, is the default on Cisco serial interfaces. It works perfectly between two Cisco routers but not with other vendors, and it has no authentication.

interface serial 0/1/0
 encapsulation hdlc
 ip address 10.255.1.1 255.255.255.252
 no shutdown

Because HDLC is the default, encapsulation hdlc often does not appear in the running configuration at all.

Figure 1. Both ends of a serial link must use the same encapsulation, or the line protocol stays down.

PPP: the flexible option

PPP (Point-to-Point Protocol) is an open standard that works between any vendors. It has two parts:

LCP (Link Control Protocol) brings the link up, agrees options such as authentication, compression, multilink and the maximum frame size, checks link quality and detects looped circuits with a "magic number".
NCPs (Network Control Protocols) set up each Layer 3 protocol: IPCP for IPv4 (which can even hand an address to the far end) and IPv6CP for IPv6.

Figure 2. A PPP link moves through link set-up, optional authentication and network-layer set-up before carrying data.

Authentication with PAP and CHAP

PAP sends the username and password in clear text, once, at start-up. CHAP sends a random challenge; the far end replies with a hash made from the challenge and the shared secret, so the secret never crosses the wire, and the challenge can be repeated during the session. Use CHAP. On Cisco routers, each router needs a username entry matching the other router's hostname, with the same secret on both sides.

hostname BRANCH1
username HQ secret Lab-Chap-Secret-01
interface serial 0/1/0
 encapsulation ppp
 ppp authentication chap
 ip address 10.255.1.2 255.255.255.252

The HQ router mirrors this with username BRANCH1 and the same secret. Older IOS releases may require username ... password rather than secret for CHAP; check what your release accepts.

Real-world example: the lab link that would not come up

A college technician cabled two routers back-to-back for a CCNA practical. Both serial interfaces showed "up, line protocol down". show controllers revealed the DCE cable end had no clock rate, so she added one. The line protocol then stayed down on one side only: one router was still on default HDLC while the other was set to PPP. After matching encapsulations, the link came up but pings failed; debug ppp authentication showed CHAP failing because the username typed on one router was "Branch1" while the hostname was "BRANCH1". Usernames are case-sensitive. Fixing it brought the link up, and students learned the troubleshooting order: physical and clock, encapsulation, then authentication.

show interfaces serial 0/1/0
show ip interface brief
debug ppp negotiation
debug ppp authentication
undebug all

Practice

Two Cisco routers are joined by a back-to-back serial cable and the link stays down. What should you check first?

That the DCE end has a clock rate configured, using show controllers to see which end is DCE.

Why might a Cisco router fail to bring up an HDLC link to another vendor's router?

Cisco HDLC adds a proprietary type field, so it is only reliably compatible with Cisco devices. Use PPP between vendors.

Why is CHAP preferred to PAP?

CHAP never sends the shared secret; it sends a hash of a random challenge and can re-challenge during the session. PAP sends the password in clear text.

Key takeaways

The DCE end of a serial link supplies the clock; set clock rate on it in labs.
Cisco HDLC is the default serial encapsulation and is Cisco-only.
PPP is open: LCP sets up the link, NCPs such as IPCP carry network protocols.
Use CHAP: usernames must match the peer hostname exactly, with a shared secret.
Troubleshoot in order: physical and clock, encapsulation, authentication.

Tracks your learning on this device only. See your progress on the learning paths.

About the author

Mohamed Fayas

Founder of FM TecHub. CCNA certified, with a BTEC HND in Network Engineering, and BEng (Hons) in Computer Networking and Cloud Security. He writes practical, plain-English guides on networking, security and cloud.

More about the author