PPP认证.docx

1、PPP认证实训十四 路由器串口PPP-PAP配置一、实训目的(1) 掌握PAP验证配置(2) 理解验证过程二、应用环境基于安全的考虑，需要路由器双方经过验证后才能建立连接。本实训使用DCR-1702路由器作为演示设备，软件版本为：1.3.2E/1.3.3A，实际使用中由于设备和软件版本不同，功能和配置方法将有可能存在差异，请关注相应版本的使用说明发布。三、实训设备(1) DCR路由器 2台(2) CR-V35MT 1条(3) CR-V35FC 1条四、实训拓扑五、实训要求 Router-A Router-B接口 IP地址 接口 IP地址S1/1 DCE 192.168.1.1 S1/0 DTE

2、 192.168.1.2帐号 密码 帐号 密码RouterA digitalchinaA RouterB digitalchinaB六、实训步骤第一步 Router-A的配置如果软件为1.3.3A及其之后的版本，参考如下配置序列。Routerenable /进入特权模式Router #config /进入全局配置模式Router _config#hostname Router-A /修改机器名Router-A_config#aaa authentication ppp test localRouter-A_config#username RouterB password digitalchin

3、aB /设置帐号密码Router-A_config#interface s1/0 /进入接口模式Router-A_config_s1/0#ip address 192.168.1.1 255.255.255.0 /配置IP地址Router-A_config_s1/0#encapsulation PPP /封装PPP协议Router-A_config_s1/0#ppp authentication pap test /设置验证方式Router-A_config_s1/0#ppp pap sent-username RouterA password digitalchinaA /设置发送给对方验证

4、的帐号密码Router-A_config_s1/0#physical-layer speed 64000 /配置DCE时钟频率Router-A_config_s1/0#no shutdown Router-A_config_s1/0#Z以下配置序列适用于软件版本为1.3.3A之前的设备Routerenable /进入特权模式Router #config /进入全局配置模式Router _config#hostname Router-A /修改机器名Router-A_config#username RouterB password digitalchinaB /设置帐号密码Router-A_co

5、nfig#interface s1/1 /进入接口模式Router-A_config_s1/0#ip address 192.168.1.1 255.255.255.0 /配置IP地址Router-A_config_s1/1#encapsulation PPP /封装PPP协议Router-A_config_s1/0#ppp authentication pap /设置验证方式Router-A_config_s1/0#ppp pap sent-username RouterA password digitalchinaA /设置发送给对方验证的帐号密码Router-A_config_s1/0#

6、physical-layer speed 64000 /配置DCE时钟频率Router-A_config_s1/0#no shutdown Router-A_config_s1/0#Z /按ctrl + z进入特权模式第二步：查看配置Router-A#show interface s1/1 /查看接口状态Serial1/0 is up, line protocol is down /对端没有配置，所以协议是DOWN Mode=Sync DCE Speed=64000 /查看DCE DTR=UP,DSR=UP,RTS=UP,CTS=DOWN,DCD=UP Interface address is

7、 192.168.1.1/24 /查看IP地址 MTU 1500 bytes, BW 64 kbit, DLY 2000 usec Encapsulation prototol PPP, link check interval is 10 sec /查看封装协议Octets Received0, Octets Sent 0Frames Received 0, Frames Sent 0, Link-check Frames Received0Link-check Frames Sent 89, LoopBack times 0Frames Discarded 0, Unknown Protoc

8、ols Frames Received 0, Sent failuile 0 Link-check Timeout 0, Queue Error 0, Link Error 0, 60 second input rate 0 bits/sec, 0 packets/sec! 60 second output rate 0 bits/sec, 0 packets/sec! 0 packets input, 0 bytes, 8 unused_rx, 0 no buffer 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

9、8 packets output, 192 bytes, 0 unused_tx, 0 underruns error: 0 clock, 0 grace PowerQUICC SCC specific errors: 0 recv allocb mblk fail 0 recv no buffer0 transmitter queue full 0 transmitter hwqueue_full第三步：Router-B的配置如果软件为1.3.3A及其之后的版本，参考如下配置序列。Routerenable /进入特权模式Router #config /进入全局配置模式Router _conf

10、ig#hostname Router-B /修改机器名Router-B_config#aaa authentication ppp test localRouter-B_config#username RouterA password digitalchinaA !设置帐号密码Router-B_config#interface s1/0 /进入接口模式Router-B_config_s1/0#ip address 192.168.1.2 255.255.255.0 /配置IP地址Router-B_config_s1/0#encapsulation PPP /封装PPP协议Router-B_co

11、nfig_s1/0#ppp authentication pap test /设置验证方式Router-B_config_s1/0#ppp pap sent-username RouterB password digitalchinaB /设置发送给对方验证的帐号密码Router-B_config_s1/0#shutdown Router-B_config_s1/0#no shutdown Router-B_config_s1/0#Z /按ctrl + z进入特权模式以下配置序列适用于软件版本为1.3.3A之前的设备Routerenable /进入特权模式Router #config /进入全

12、局配置模式Router _config#hostname Router-B /修改机器名Router-B_config#username RouterA password digitalchinaA !设置帐号密码Router-B_config#interface s1/0 /进入接口模式Router-B_config_s1/0#ip address 192.168.1.2 255.255.255.0 /配置IP地址Router-B_config_s1/1#encapsulation PPP /封装PPP协议Router-B_config_s1/0#ppp authentication pap

13、 /设置验证方式Router-B_config_s1/0#ppp pap sent-username RouterB password digitalchinaB /设置发送给对方验证的帐号密码Router-B_config_s1/0#no shutdown Router-B_config_s1/0#Z /按ctrl + z进入特权模式第四步：查看配置Router-A#show interface s1/0 /查看接口状态Serial1/0 is up, line protocol is up /接口和协议都是up Mode=Sync DTE /查看DTE DTR=UP,DSR=UP,RTS=

14、UP,CTS=DOWN,DCD=UP Interface address is 192.168.1.2/24 /查看IP地址 MTU 1500 bytes, BW 64 kbit, DLY 2000 usec Encapsulation prototol PPP, link check interval is 10 sec /查看封装协议Octets Received0, Octets Sent 0Frames Received 0, Frames Sent 0, Link-check Frames Received0Link-check Frames Sent 89, LoopBack ti

15、mes 0Frames Discarded 0, Unknown Protocols Frames Received 0, Sent failuile 0 Link-check Timeout 0, Queue Error 0, Link Error 0, 60 second input rate 0 bits/sec, 0 packets/sec! 60 second output rate 0 bits/sec, 0 packets/sec! 0 packets input, 0 bytes, 8 unused_rx, 0 no buffer 0 input errors, 0 CRC,

16、0 frame, 0 overrun, 0 ignored, 0 abort 8 packets output, 192 bytes, 0 unused_tx, 0 underruns error: 0 clock, 0 grace PowerQUICC SCC specific errors: 0 recv allocb mblk fail 0 recv no buffer0 transmitter queue full 0 transmitter hwqueue_full第五步：测试连通性Router-A#ping 192.168.1.2PING 192.168.1.2 (192.168.

17、1.2): 56 data bytes!- 192.168.1.2 ping statistics -5 packets transmitted, 5 packets received, 0% packet lossround-trip min/avg/max = 20/22/30 ms七、注意事项和排错(1) 帐号密码一定要交叉对应，发送的帐号密码要和对方帐号数据库中的帐号密码对应。(2) 不要忘记配置DCE的时钟频率。八、配置序列Router-A的序列Building configuration.Current configuration:!version 1.3.2Eservice ti

18、mestamps log dateservice timestamps debug dateno service password-encryption!hostname Router-A!username routerb password 0 digitalb!interface FastEthernet0/0 ip address 192.168.2.1 255.255.255.0 no ip directed-broadcast!interface Ethernet2/0 no ip address no ip directed-broadcast duplex half!interfa

19、ce Serial1/0 no ip address no ip directed-broadcast physical-layer speed 64000!interface Serial1/1 ip address 192.168.1.1 255.255.255.0 no ip directed-broadcast encapsulation ppp ppp pap sent-username routera digitala physical-layer speed 64000!interface Async0/0 no ip address no ip directed-broadca

20、st!九、共同思考(1) 在什么环境下需要配置验证方式？(2) PAP验证是否非常安全？十、课后练习本实训是双向验证，尝试做单向验证的配置。十一、命令详解ppp authentication 使用接口配置命令ppp authentication指定接口上使用CHAP或PAP协议的次序，使用no ppp authentication 取消认证。 ppp authentication chap|ms-chap|paplist-name|defaultcallin no ppp authentication 命令目的chap在串行接口上激活CHAPpap在串行接口上激活PAPms-chap在串行接口

21、上激活MS-CHAPlist-name（可选的）与AAA/TACACS+一起使用，指定执行认证时使用的TACACS方法列表名。如果没有指定列表名，系统将使用缺省列表。使用命令aaa authentication ppp创建列表。default（可选的）与AAA/TACACS+一起使用。使用命令aaa authentication ppp 创建缺省缺省列表。callin（可选的）指定仅对收到的呼叫（calls）进行认证。实训十五 路由器串口PPP-CHAP配置一、实训目的(1) 掌握CHAP验证配置(2) 理解验证过程二、应用环境基于安全的考虑，需要路由器双方经过验证后才能建立连接。本实训使用D

22、CR-1702路由器作为演示设备，软件版本为：1.3.2E/1.3.3A，实际使用中由于设备和软件版本不同，功能和配置方法将有可能存在差异，请关注相应版本的使用说明发布。三、实训设备(1) DCR路由器 2台(2) CR-V35MT 1条(3) CR-V35FC 1条四、实训拓扑同实训二十八。五、实训要求 Router-A Router-B接口 IP地址 接口 IP地址S1/1 DCE 192.168.1.1 S1/0 DTE 192.168.1.2帐号 密码 帐号 密码RouterA digitalchina RouterB digitalchina六、实训步骤第一步 Router-A的配置

23、如果软件为1.3.3A及其之后的版本，参考如下配置序列。Routerenable /进入特权模式Router #config /进入全局配置模式Router _config#hostname Router-A /修改机器名Router-A_config# aaa authentication ppp test local/定义一个名为test，使用本地数据进行验证的aaa验证方法Router-A_config#username RouterB password digitalchina /设置帐号密码Router-A_config#interface s1/0 /进入接口模式Router-A_

24、config_s1/0#ip address 192.168.1.1 255.255.255.0 /配置IP地址Router-A_config_s1/0#encapsulation PPP /封装PPP协议Router-A_config_s1/0# ppp authentication chap test /设置验证方式Router-A_config_s1/0#ppp chap hostname RouterA /设置发送给对方验证的帐号Router-A_config_s1/0#physical-layer speed 64000 /配置DCE时钟频率Router-A_config_s1/0#

25、no shutdown Router-A_config_s1/0#Z /按ctrl + z进入特权模式以下配置序列适用于软件版本为1.3.3A之前的设备Routerenable /进入特权模式Router #config /进入全局配置模式Router _config#hostname Router-A /修改机器名Router-A_config#username RouterB password digitalchina /设置帐号密码Router-A_config#interface s1/1 /进入接口模式Router-A_config_s1/0#ip address 192.168.1

26、.1 255.255.255.0 /配置IP地址Router-A_config_s1/1#encapsulation PPP /封装PPP协议Router-A_config_s1/0#ppp authentication chap /设置验证方式Router-A_config_s1/0#ppp chap hostname RouterA /设置发送给对方验证的帐号Router-A_config_s1/0#physical-layer speed 64000 /配置DCE时钟频率Router-A_config_s1/0#no shutdown Router-A_config_s1/0#Z /按c

27、trl + z进入特权模式第二步：查看配置Router-A#show interface s1/1 /查看接口状态Serial1/0 is up, line protocol is down /对端没有配置，所以协议是DOWN Mode=Sync DCE Speed=64000 /查看DCE DTR=UP,DSR=UP,RTS=UP,CTS=DOWN,DCD=UP Interface address is 192.168.1.1/24 /查看IP地址 MTU 1500 bytes, BW 64 kbit, DLY 2000 usec Encapsulation prototol PPP, li

28、nk check interval is 10 sec /查看封装协议Octets Received0, Octets Sent 0Frames Received 0, Frames Sent 0, Link-check Frames Received0Link-check Frames Sent 89, LoopBack times 0Frames Discarded 0, Unknown Protocols Frames Received 0, Sent failuile 0 Link-check Timeout 0, Queue Error 0, Link Error 0, 60 sec

29、ond input rate 0 bits/sec, 0 packets/sec! 60 second output rate 0 bits/sec, 0 packets/sec! 0 packets input, 0 bytes, 8 unused_rx, 0 no buffer 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 8 packets output, 192 bytes, 0 unused_tx, 0 underruns error: 0 clock, 0 grace PowerQUICC SCC specific errors: 0 recv allocb mblk fail 0 recv no buffer