网络工程师Day2---实验2-1：HDLC和PPP配置
网络工程师Day2—实验2-1：HDLC和PPP配置
学习目标
掌握HDLC的基本配置方法
掌握DCE时钟波特率的配置方法
掌握PPP的基本配置方法
掌握PPP链路的PAP认证的配置方法
掌握PPP链路的CHAP认证的配置方法
拓扑图
场景
您是公司的网络管理员，公司总部有一台路由器R2，R1和R3分别是其他两个分部的路由器。现在您需要将总部网络和分部网络通过广域网连接起来。在广域网链路上尝试使用HDLC和PPP协议，并在使用PPP协议时配置了不同的认证方式保证安全。
操作步骤
步骤一 实验环境准备
R1
sys
Enter system view, return user view with Ctrl+Z.
[R1]un in en
[Huawei]sysn R1
Info: Information center is disabled.
[R1]int s0/0/0
[R1-Serial0/0/0]ip add 10.0.12.1 24
[R1-Serial0/0/0]quit
R2
sys
Enter system view, return user view with Ctrl+Z.
[Huawei]un in en
Info: Information center is disabled.
[Huawei]sysn R2
[R2]int s0/0/0
[R2-Serial0/0/0]ip add 10.0.12.2 24
[R2-Serial0/0/0]int s0/0/1
[R2-Serial0/0/1]ip add 10.0.23.2 24
[R2-Serial0/0/1]quit
R3
sys
Enter system view, return user view with Ctrl+Z.
[Huawei]un in en
Info: Information center is disabled.
[Huawei]sysn R3
[R3]int s0/0/0
[R3-Serial0/0/0]ip add 10.0.23.3 24
[R3-Serial0/0/0]quit
步骤二 在串行接口上启用HDLC协议
R1
[R1]int s0/0/0
[R1-Serial0/0/0]link-protocol hdlc
Warning: The encapsulation protocol of the link will be changed.
Continue? [Y/N]:y
R2
[R2]int s0/0/0
[R2-Serial0/0/0]link-protocol hdlc
Warning: The encapsulation protocol of the link will be changed.
Continue? [Y/N]:y
[R2-Serial0/0/0]int s0/0/1
[R2-Serial0/0/1]link-protocol hdlc
Warning: The encapsulation protocol of the link will be changed.
Continue? [Y/N]:y
R3
[R3]int s0/0/0
[R3-Serial0/0/0]link-protocol hdlc
Warning: The encapsulation protocol of the link will be changed.
Continue? [Y/N]:y
配置完成后，查看串行接口的状态，以R1上的显示信息为例：
[R1]disp int s0/0/0
Serial0/0/0 current state : UP
Line protocol current state : UP
Last line protocol up time : 2019-08-21 15:12:45 UTC-08:00
Description:
Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
Internet Address is 10.0.12.1/24
Link layer protocol is nonstandard HDLC
Last physical up time : 2019-08-21 15:06:26 UTC-08:00
Last physical down time : 2019-08-21 15:06:25 UTC-08:00
Current system time: 2019-08-21 15:15:56-08:00Interface is V35
Last 300 seconds input rate 2 bytes/sec, 0 packets/sec
Last 300 seconds output rate 2 bytes/sec, 0 packets/sec
Input: 2480 bytes, 175 Packets
Ouput: 2556 bytes, 164 Packets
Input bandwidth utilization : 0.02%
Output bandwidth utilization : 0.02%
确定该接口的物理状态和协议状态均以UP后，检测直连链路的连通性。
ping 10.0.12.1
PING 10.0.12.1: 56 data bytes, press CTRL_C to break
Reply from 10.0.12.1: bytes=56 Sequence=1 ttl=255 time=90 ms
Reply from 10.0.12.1: bytes=56 Sequence=2 ttl=255 time=30 ms
Reply from 10.0.12.1: bytes=56 Sequence=3 ttl=255 time=10 ms
Reply from 10.0.12.1: bytes=56 Sequence=4 ttl=255 time=50 ms
Reply from 10.0.12.1: bytes=56 Sequence=5 ttl=255 time=50 ms
--- 10.0.12.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 10/46/90 ms
步骤三 配置OSPF
在三台路由器上都启用OSPF路由协议，并发布各自的直连路由
R1
sys
Enter system view, return user view with Ctrl+Z.
[R1]ospf
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 10.0.12.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]quit
R2
sys
Enter system view, return user view with Ctrl+Z.
[R2]ospf
[R2-ospf-1]area 0
[R2-ospf-1-area-0.0.0.0]network 10.0.12.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]network 10.0.23.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]quit
R3
sys
Enter system view, return user view with Ctrl+Z.
[R3]ospf
[R3-ospf-1]area 0
[R3-ospf-1-area-0.0.0.0]network 10.0.23.0 0.0.0.255
[R3-ospf-1-area-0.0.0.0]quit
[R3-ospf-1]quit
当所有的路由都学习到之后，使用R1pingR3测试是否网络联通
[R1]ping 10.0.23.3
PING 10.0.23.3: 56 data bytes, press CTRL_C to break
Reply from 10.0.23.3: bytes=56 Sequence=1 ttl=254 time=50 ms
Reply from 10.0.23.3: bytes=56 Sequence=2 ttl=254 time=80 ms
Reply from 10.0.23.3: bytes=56 Sequence=3 ttl=254 time=70 ms
Reply from 10.0.23.3: bytes=56 Sequence=4 ttl=254 time=40 ms
Reply from 10.0.23.3: bytes=56 Sequence=5 ttl=254 time=40 ms
--- 10.0.23.3 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 40/56/80 ms
步骤四 管理串口连接
查看串行接口连接的线缆类型、接口状态和时钟频率，并修改时钟频率。
[R1]dis int s0/0/0
Serial0/0/0 current state : **UP**
Line protocol current state : **UP**
## Last line protocol up time : 2019-08-21 15:12:45 UTC-08:00 ##
Description:
Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
Internet Address is 10.0.12.1/24
Link layer protocol is nonstandard HDLC
Last physical up time : 2019-08-21 15:06:26 UTC-0 8:00
Last physical down time : 2019-08-21 15:06:25 UTC-08:00
Current system time: 2019-08-21 21:48:31-08:00Interface is V35
Last 300 seconds input rate 10 bytes/sec, 0 packets/sec
Last 300 seconds output rate 10 bytes/sec, 0 packets/sec
Input: 20792 bytes, 822 Packets
Ouput: 21164 bytes, 818 Packets
Input bandwidth utilization : 0.12%
Output bandwidth utilization : 0.12%
回显信息表明R1的S0/0/0接口连接的是DCE线缆，时钟频率是64000bit/s。DCE设备可以控制时钟频率和带宽。
将R1和R2间链路的时钟频率修改为128000bit/s。这一操作需在DCE设备R1上执行。
这个地方发现实验设备没有和指导书中一样。
不能修改端口速率
尝试其他设备特别是书中的R2220 AR2220没有Serical口。
步骤五 修改串行接口的封装类型为PPP
在R1和R2以及R2和R3间修改串行接口使用PPP封装，链路两端必须配置相同的封装类型，否则接口状态就会出现DOWN的情况
R1
[R1]int s0/0/0
[R1-Serial0/0/0]link-protocol ppp
Warning: The encapsulation protocol of the link will be changed.
Continue? [Y/N]:y
R2
sys
Enter system view, return user view with Ctrl+Z.
[R2]int s0/0/0
[R2-Serial0/0/0]link-protocol ppp
Warning: The encapsulation protocol of the link will be changed.
Continue? [Y/N]:y
[R2-Serial0/0/0]quit
[R2]link-protocol ppp
[R2]int s0/0/1
[R2-Serial0/0/1]link-protocol ppp
Warning: The encapsulation protocol of the link will be changed.
Continue? [Y/N]:y
[R2-Serial0/0/1]quit
R3
sys
Enter system view, return user view with Ctrl+Z.
[R3]int s0/0/0
[R3-Serial0/0/0]
[R3-Serial0/0/0]link-protocol ppp
Warning: The encapsulation protocol of the link will be changed.
Continue? [Y/N]:y
[R3-Serial0/0/0]quit
配置完成后，检测链路联通性。
R2
[R2]ping 10.0.12.1
PING 10.0.12.1: 56 data bytes, press CTRL_C to break
Reply from 10.0.12.1: bytes=56 Sequence=1 ttl=255 time=60 ms
Reply from 10.0.12.1: bytes=56 Sequence=2 ttl=255 time=50 ms
Reply from 10.0.12.1: bytes=56 Sequence=3 ttl=255 time=30 ms
Reply from 10.0.12.1: bytes=56 Sequence=4 ttl=255 time=50 ms
Reply from 10.0.12.1: bytes=56 Sequence=5 ttl=255 time=40 ms
--- 10.0.12.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 30/46/60 ms
[R2]ping 10.0.23.3
PING 10.0.23.3: 56 data bytes, press CTRL_C to break
Reply from 10.0.23.3: bytes=56 Sequence=1 ttl=255 time=30 ms
Reply from 10.0.23.3: bytes=56 Sequence=2 ttl=255 time=10 ms
Reply from 10.0.23.3: bytes=56 Sequence=3 ttl=255 time=50 ms
Reply from 10.0.23.3: bytes=56 Sequence=4 ttl=255 time=1 ms
Reply from 10.0.23.3: bytes=56 Sequence=5 ttl=255 time=20 ms
--- 10.0.23.3 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/22/50 ms
查看端口状态
[R2]dis int s0/0/0
Serial0/0/0 current state : UP
Line protocol current state : UP
Last line protocol up time : 2019-08-21 22:32:06 UTC-08:00
Description:
Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
Internet Address is 10.0.12.2/24
Link layer protocol is PPP
LCP opened, IPCP opened
Last physical up time : 2019-08-21 22:32:06 UTC-08:00
Last physical down time : 2019-08-21 22:32:06 UTC-08:00
Current system time: 2019-08-21 22:43:45-08:00Interface is V35
Last 300 seconds input rate 10 bytes/sec, 0 packets/sec
Last 300 seconds output rate 10 bytes/sec, 0 packets/sec
Input: 54874 bytes, 1589 Packets
Ouput: 64946 bytes, 1597 Packets
Input bandwidth utilization : 0.12%
Output bandwidth utilization : 0.12%
步骤六 检查路由表项的变化
PPP配置完成后，路由器之间会建立数据链路层的连接。本地路由器会向远端路由器发送一条主机路由，路由信息中包含本地接口的IP地址，掩码为32位。
[R2]dis ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 8Routes : 8
Destination/MaskProto Pre Cost Flags NextHop Interface
10.0.12.0/24 Direct 00 D 10.0.12.2 Serial0/0/0
10.0.12.1/32 Direct 00 D 10.0.12.1 Serial0/0/0
10.0.12.2/32 Direct 00 D 127.0.0.1 Serial0/0/0
10.0.23.0/24 Direct 00 D 10.0.23.2 Serial0/0/1
10.0.23.2/32 Direct 00 D 127.0.0.1 Serial0/0/1
10.0.23.3/32 Direct 00 D 10.0.23.3 Serial0/0/1
127.0.0.0/8 Direct 00 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 00 D 127.0.0.1 InLoopBack0
可以看出，路由表中已经包含通往R1和R3的路由，回顾下这两条路由的由来和功能，回答下面两个问题：
如果配置的是HDLC封装，路由表中还会有这两条路由吗
将其改为HDLC封装，其路由表为
[R2]dis ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 6Routes : 6
Destination/MaskProto Pre Cost Flags NextHop Interface
10.0.12.0/24 Direct 00 D 10.0.12.2 Serial0/0/0
10.0.12.2/32 Direct 00 D 127.0.0.1 Serial0/0/0
10.0.23.0/24 Direct 00 D 10.0.23.2 Serial0/0/1
10.0.23.2/32 Direct 00 D 127.0.0.1 Serial0/0/1
127.0.0.0/8 Direct 00 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 00 D 127.0.0.1 InLoopBack0
如果R1和R2上的S1/0/0接口IP地址不在同一网段，它们之间还能够通过HDLC或者PPP通信吗？
[R1]ping 10.0.22.1
PING 10.0.22.1: 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out
--- 10.0.22.1 ping statistics ---
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss
步骤七 在R1和R2间的PPP链路启用PAP认证功能
配置PAP认证功能，并将R1配置为PAP认证方。
[R1]interface s0/0/0
[R1-Serial0/0/0]ppp authentication-mode pap
[R1-Serial0/0/0]quit
[R1]display interface s0/0/0
Serial0/0/0 current state : UP
Line protocol current state : UP
Last line protocol up time : 2019-08-21 23:13:29 UTC-08:00
Description:
Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
Internet Address is 10.0.12.1/24
Link layer protocol is PPP
LCP opened, IPCP opened
Last physical up time : 2019-08-21 23:13:14 UTC-08:00
Last physical down time : 2019-08-21 23:13:13 UTC-08:00
Current system time: 2019-08-21 23:14:01-08:00Interface is V35
Last 300 seconds input rate 7 bytes/sec, 0 packets/sec
Last 300 seconds output rate 10 bytes/sec, 0 packets/sec
Input: 80612 bytes, 2000 Packets
Ouput: 84272 bytes, 2057 Packets
Input bandwidth utilization : 0.08%
Output bandwidth utilization : 0.12%
将R2配置为PAP的被认证方
[R2-Serial0/0/0]ppp pap local-user huawei password cipher huawei123
[R2-Serial0/0/0]quit
[R2]dis int s0/0/0
Serial0/0/0 current state : UP
Line protocol current state : UP
Last line protocol up time : 2019-08-21 23:13:29 UTC-08:00
Description:
Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
Internet Address is 10.0.12.2/24
Link layer protocol is PPP
LCP opened, IPCP opened
Last physical up time : 2019-08-21 23:13:28 UTC-08:00
Last physical down time : 2019-08-21 23:13:27 UTC-08:00
Current system time: 2019-08-21 23:16:38-08:00Interface is V35
Last 300 seconds input rate 11 bytes/sec, 0 packets/sec
Last 300 seconds output rate 11 bytes/sec, 0 packets/sec
Input: 85712 bytes, 2102 Packets
Ouput: 82142 bytes, 2047 Packets
Input bandwidth utilization : 0.13%
Output bandwidth utilization : 0.13%
配置完成后，检测R1和R2间的连通性，并通过debug功能观察PAP认证报文的交互
debugging ppp pap packet
terminal debugging
Info: Current terminal debugging is on.
PPP Packet:
Serial0/0/0 Input PAP(c023) Pkt, Len 25
State ServerListen, code Request(01), id 1, len 21
Host Len: 6 Name:huawei
Pwd Len: 9 Pwd:huawei123
undo debugging all
步骤八 在R2和R3间的PPP链路上启用CHAP认证功能
将R3配置为CHAP的认证方
[R3-Serial0/0/0]ppp authentication-mode chap
[R3-Serial0/0/0]quit
[R3]aaa
[R3-aaa]local-user huawei password cipher huawei123
Info: Add a new user.
[R3-aaa]local-user huawei service-type ppp
[R3-aaa]quit
将R2的S0/0/1接口配置成被认证方
[R2-Serial0/0/1]ppp chap user huawei
[R2-Serial0/0/1]ppp chap password cipher huawei123
使用R2进行链路的测试
[R2]ping 10.0.23.3
PING 10.0.23.3: 56 data bytes, press CTRL_C to break
Reply from 10.0.23.3: bytes=56 Sequence=1 ttl=255 time=50 ms
Reply from 10.0.23.3: bytes=56 Sequence=2 ttl=255 time=50 ms
Reply from 10.0.23.3: bytes=56 Sequence=3 ttl=255 time=30 ms
Reply from 10.0.23.3: bytes=56 Sequence=4 ttl=255 time=50 ms
Reply from 10.0.23.3: bytes=56 Sequence=5 ttl=255 time=10 ms
--- 10.0.23.3 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 10/38/50 ms
步骤九 使用debug命令查看R2和R3之间使用CHAP建立PPP连接的协商过程
查看R2与R3建立ppp连接时的协商情况，为了看到完整的协商过程，需要先关闭R2的S0/0/1接口，然后启动debug命令，再打开接口，就可以看到完整的协商过程。
首先关闭R2的S0/0/1接口。
[R2-Serial0/0/1]shutdown
为了避免S0/0/0接口信息对我们的干扰，此时也可关闭S0/0/0
[R2-Serial0/0/0]shutdown
执行debugging ppp chap all 和terminal debugging 命令，查看debug信息。
debugging ppp chap all
terminal debugging
Info: Current terminal debugging is on.
display debugging
PPP CHAP packets debugging switch is on
PPP CHAP events debugging switch is on
PPP CHAP errors debugging switch is on
PPP CHAP state change debugging switch is on
打开R2的物理接口S0/0/1，发起认证
[R2-Serial0/0/1]un shutdown
此时可以看到相应的debug信息流出
PPP State Change:
Serial0/0/1 CHAP : Initial --> ListenChallenge
Aug 21 2019 23:41:55.130.4-08:00 R2 PPP/7/debug2:
PPP Packet:
Serial0/0/1 Input CHAP(c223) Pkt, Len 25
State ListenChallenge, code Challenge(01), id 1, len 21
Value_Size: 16 Value: f2 47 48 13 d9 66 37 2a af 4f f6 3f 34 39 90 29
Name:
Aug 21 2019 23:41:55.130.5-08:00 R2 PPP/7/debug2:
附加练习
为什么PPP中CHAP认证比PAP认证的安全性更高？
链接：https://www.nowcoder.com/questionTerminal/23017970388842c4b3181f37da7e085d?toCommentId=622758
来源：牛客网
PAP：密码口令验证协议，全称：Password Authentication Protocol。PAP是两次握手认证协议，在链路首次初始化时，被认证端首先发起认证请求，向认证端发送用户名和密码信息进行身份认证。密码口令以明文发送，所以安全性较低。 CHAP：挑战握手认证协议，全称：Challenge Handshake Authentication Protocol。CHAP通过三次握手验证被认证端的身份，在初始链路建立时完成，为了提高安全性，在链路建立之后周期性进行验证。CHAP比PAP更安全，因为CHAP不在线路上发送明文，而是发送经过MD5过的随机数序列。