实验四 PPP协议实验.docx

1、实验四 PPP协议实验实验四 PPP协议实验1 广域网链路认证（PAP）【背景描述】你是公司的网络管理员，两个分公司之间希望能够申请一条广域网专线进行连接。 现有锐捷路由器两台，希望你了解该设备的广域网接口所支持的协议，以确定选择哪种广域网链路。公司为了满足不断增长的业务需求，申请了专线接入，你的客户端与ISP进行链路协商时要验证身份，配置路由器保证链路建立，并考虑其安全性。【实现功能】 在链路协商时保证安全验证。链路协商时用户名、密码以明文的方式传输。【使用设备】设备类型设备名称设备数量交换机路由器Router2三层交换机串口线1计算机【实验拓扑】【实现步骤】步骤1 基本配置Router(c

2、onfig)#hostname RaRa(config)#interface serial 0Ra(config-if)#ip address 1.1.1.1 255.255.255.0Ra(config-if)#no shutdownRa(config-if)#exitRouter(config)#hostname RbRb(config)#interface serial 0Rb(config-if)#ip address 1.1.1.2 255.255.255.0Rb(config-if)#no shutdown验证测试：(以Ra为例)Ra#show interfaces serial

3、0Serial0 is up, line protocol is up Hardware is HDLC4530A Internet address is 1.1.1.1/24 MTU 1500 bytes, BW 2048 Kbit, DLY 20000 usec, rely 255/255, load 1/255 Encapsulation HDLC, loopback not set, keepalive set (10 sec) Last input 00:00:09, output 00:00:08, output hang never Last clearing of show i

4、nterface counters never Input queue: 0/75/0 (size/max/drops); Total output drops: 0 Queueing strategy: weighted fair Output queue: 65531/64/0 (size/threshold/drops) Conversations 0/1 (active/max active) Reserved Conversations 0/0 (allocated/max allocated) 5 minute input rate 0 bits/sec, 0 packets/se

5、c 5 minute output rate 0 bits/sec, 0 packets/sec 409 packets input, 57032 bytes, 0 no buffer Received 404 broadcasts 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 163 packets output, 4312 bytes, 0 underruns 0 output errors, 0 collisions, 31 interface resets 0 output buffer failures,

6、0 output buffers swapped out 0 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up步骤2 配置PPP认证.被验证方的配置Ra(config)#interface serial 0Ra(config-if)#encapsulation ppp !在接口下封装PPP协议Ra(config-if)#ppp pap sent-username Ra password 0 star !PPP认证的用户名、密码验证方的配置Rb(config)#username Ra password 0 star !验证方配置被验证方

7、的用户名、密码Rb(config)#interface serial 0Rb(config-if)#encapsulation pppRb(config-if)#ppp authentication pap !PPP启用PAP验证过程验证测试Ra#debug ppp authentication !观察PAP认证过程(这儿认证显示不详细)PPP authentication debugging is onRa#PPP Serial0: PAP ACKRemote message is:PPP Serial0: Passed PAP authentication with remote参考配置R

8、a#show running-config !路由器Ra的配置Building configuration.Current configuration:!version 6.14(9coll)!hostname Ra!ip subnet-zero!interface FastEthernet0 no ip address shutdown!interface FastEthernet1 no ip address shutdown!interface FastEthernet2 no ip address shutdown!interface FastEthernet3 no ip addre

9、ss shutdown!interface Serial0 ip address 1.1.1.1 255.255.255.0 encapsulation ppp ppp pap sent-username Ra password 7 1234111358!interface Serial1 no ip address shutdown!interface Serial2 no ip address shutdown!interface Serial3 no ip address shutdown!ip classless!line con 0line aux 0line vty 0 4 log

10、inline vty 5 19 login!endRb#show running-config !路由器Rb的配置Building configuration.Current configuration:!version 6.14(9coll)!hostname Rb!username Ra password 7 0059344251!ip subnet-zero!interface FastEthernet0 no ip address shutdown!interface FastEthernet1 no ip address shutdown!interface FastEthernet

11、2 no ip address shutdown!interface FastEthernet3 no ip address shutdown!interface Serial0 ip address 1.1.1.2 255.255.255.0 encapsulation ppp clock rate 64000 ppp authentication pap!interface Serial1 no ip address shutdown!ip classless!line con 0line aux 0line vty 0 4 loginline vty 5 19 login!end【注意事

12、项】1.在DCE端配置时钟频率2.Rb(config)#username Ra password 0 star ！username后面的参数是对方的主机名3.在接口下封装PAP认证4.debug ppp authentication !在路由器物理层up,链路尚未建立的情况下打开才有消息输出, 本实验的实质是链路层协商建立的安全性,该信息出现在链路协商的过程中.2 广域网链路认证（CHAP）【背景描述】你是网络管理员：两个分公司之间希望能够申请一条广域网专线进行连接。公司现有锐捷路由器两台，希望你了解该设备的广域网接口所支持的协议，以确定选择哪种广域网链路。 公司为了满足不断增长的业务需求，申

13、请了专线接入，你的客户端与ISP进行链路协商时要验证身份，配置路由器保证链路建立，并考虑其安全性。【实现功能】 在链路协商时保证安全验证。链路协商时以密文的方式传输，更安全。【使用设备】设备类型设备名称设备数量交换机路由器router2三层交换机串口线1计算机【案例拓扑】【实现过程】步骤1 基本配置Router(config)#hostname RaRa(config)#interface serial 0Ra(config-if)#ip address 1.1.1.1 255.255.255.0Ra(config-if)#no shutdownRouter(config)#hostname

14、RbRb(config)#interface serial 0Rb(config-if)#ip address 1.1.1.2 255.255.255.0Rb(config-if)#clock rate 64000Rb(config-if)#no shutdown验证测试:(以Ra为例)Ra#show interfaces serial 0Serial0 is up, line protocol is up Hardware is HDLC4530A Internet address is 1.1.1.1/24 MTU 1500 bytes, BW 2048 Kbit, DLY 20000 u

15、sec, rely 255/255, load 1/255 Encapsulation HDLC, loopback not set, keepalive set (10 sec) Last input 00:00:00, output 00:00:04, output hang never Last clearing of show interface counters never Input queue: 0/75/0 (size/max/drops); Total output drops: 0 Queueing strategy: weighted fair Output queue:

16、 0/64/0 (size/threshold/drops) Conversations 0/1 (active/max active) Reserved Conversations 0/0 (allocated/max allocated) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 864 packets input, 66556 bytes, 0 no buffer Received 484 broadcasts 0 input errors, 0

17、 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 647 packets output, 14520 bytes, 0 underruns 0 output errors, 0 collisions, 49 interface resets 0 output buffer failures, 0 output buffers swapped out 0 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up步骤2 配置PPP PAP 认证Ra(config)#username Rb password

18、0 star !以对方的主机名作为用户名,密码和对方的路由器配置一致Ra(config)#interface serial 0Ra(config-if)#encapsulation pppRa(config-if)#ppp authentication chap !PPP启用chapRb(config)#username Ra password 0 star !以对方的主机名作为用户名,密码和对方路由器一致Rb(config)#interface serial 0Rb(config-if)#encapsulation ppp验证测试Ra#debug ppp packetPPP packet d

19、isplay debugging is onRa#PPP Serial0(i): pkt type 0xC021, datagramsize 14PPP Serial0: I LCP CONFREQ(1) id 4 len 10 MAGICNUMBER (6) 0xD1 0x50 0x30 0xA7PPP Serial0: input(0xC021) state = Open code = CONFREQ(1) id = 4 len = 10PPP Serial0: O LCP CONFREQ(1) id 73 len 15 AUTHTYPE (5) 0xC2 0x23 0x5 MAGICNU

20、MBER (6) 0xD1 0x50 0x3 0x88PPP Serial0: O LCP CONFACK(2) id 4 len 10 MAGICNUMBER (6) 0xD1 0x50 0x30 0xA7PPP Serial0(i): pkt type 0xC021, datagramsize 19PPP Serial0: I LCP CONFACK(2) id 73 len 15 AUTHTYPE (5) 0xC2 0x23 0x5 MAGICNUMBER (6) 0xD1 0x50 0x3 0x88PPP Serial0: input(0xC021) state = ACKsent c

21、ode = CONFACK(2) id = 73 len = 1PPP Serial0: O CHAP CHALLENGE(1) id 4 len 23PPP Serial0: Send CHAP challenge id=4 to remotePPP Serial0(i): pkt type 0xC223, datagramsize 27PPP Serial0: I CHAP RESPONSE(2) id 4 len 23PPP Serial0: CHAP response id=4 received from RbPPP Serial0: O CHAP SUCCESS(3) id 4 le

22、n 4PPP Serial0: Send CHAP success id=4 to remotePPP Serial0: remote passed CHAP authentication.PPP Serial0: O IPCP CONFREQ(1) id 4 len 10 Address (6) 0x1 0x1 0x1 0x1PPP Serial0(i): pkt type 0x8021, datagramsize 14PPP Serial0: I IPCP CONFREQ(1) id 4 len 10 Address (6) 0x1 0x1 0x1 0x2PPP Serial0: inpu

23、t(0x8021) state = REQsent code = CONFREQ(1) id = 4 len = 10PPP Serial0: O IPCP CONFACK(2) id 4 len 10 Address (6) 0x1 0x1 0x1 0x2PPP Serial0(i): pkt type 0x8021, datagramsize 14PPP Serial0: I IPCP CONFACK(2) id 4 len 10 Address (6) 0x1 0x1 0x1 0x1PPP Serial0: input(0x8021) state = ACKsent code = CON

24、FACK(2) id = 4 len = 10PPP Serial0: O LCP ECHOREQ(9) id 1 len 12 magic 0xD1500388PPP Serial0: echo_count 2, sent id 1, line upPPP Serial0(i): pkt type 0xC021, datagramsize 16PPP Serial0: I LCP ECHOREP(10) id 1 len 12 magic 0xD15030A7PPP Serial0: input(0xC021) state = Open code = ECHOREP(10) id = 1 l

25、en = 12PPP Serial0: rcvd id 1, sent id 1, line up参考配置Ra#show running-config !路由器Ra的配置Building configuration.Current configuration:!version 6.14(9coll)!hostname Ra!username Rb password 7 050B123F11!ip subnet-zero!interface FastEthernet0 no ip address shutdown!interface FastEthernet1 no ip address shu

26、tdown!interface FastEthernet2 no ip address shutdown!interface FastEthernet3 no ip address shutdown!interface Serial0 ip address 1.1.1.1 255.255.255.0 encapsulation ppp ppp authentication chap ppp pap sent-username Ra password 7 1234111358!interface Serial1 no ip address shutdown!interface Serial2 n

27、o ip address shutdown!interface Serial3 no ip address shutdown!ip classless!line con 0line aux 0line vty 0 4 loginline vty 5 19 login!endRb#show running-config !路由器Rb的配置Building configuration.Current configuration:!version 6.14(9coll)!hostname Rb!username Ra password 7 0059344251username Rb password

28、 7 0059344251!ip subnet-zero!interface FastEthernet0 no ip address shutdown!interface FastEthernet1 no ip address shutdown!interface FastEthernet2 no ip address shutdown!interface FastEthernet3 no ip address shutdown!interface Serial0 ip address 1.1.1.2 255.255.255.0 encapsulation ppp clock rate 640

29、00!interface Serial1 no ip address shutdown!ip classless!line con 0line aux 0line vty 0 4 loginline vty 5 19 login!end【注意事项】1.在DCE端配置时钟频率2.Ra(config)#username Rb password 0 star !username后面的参数是对方的主机名。3.Rb(config)#username Rb password 0 star !username后面的参数是对方的主机名。4.在接口下封装PPP。5.Rb#debug ppp packet !在路由器物理层up,链路建立（？）的情况下打开才有信息输出,本实验的实质是链路层协商建立的安全性,该信息出现在链路协商的过程中。