Router Configuration<13>
PPP CHAP认证
Target:
实验目的:
掌握PPP CHAP认证的过程及配置
实验设备:
路由器（带串口） 2台
V.35线缆（DTE/DCE） 1对
实验原理:
PPP协议位于OSI七层模型的数据链路层，PPP协议按照功能划分为两个子层：LCP、NCP。LCP主要负责链路的协商、建立、回拨、认证、数据的压缩、多链路捆绑等功能。NCP主要负责和上层的协议进行协商，为网络层协议提供服务。
PPP的认证功能是指在建立PPP链路的过程中进行密码的验证，验证通过建立连接，验证不通过拆除链路。
CHAP（Challenge Handshake Authentication Protocol，挑战式握手验证协议）是指验证双方通过三次握手完成验证过程，比PAP更安全。由验证方主动发出挑战报文，由被验证方应答。在整个验证过程中，链路上传递的信息都进行了加密处理。
实验拓扑图：
Step：
第一步：路由器基本配置
Router(config)#hostname Router A
Router A(config)#interface serial 4/0
Router A(config-if)#ip address 172.16.2.1 255.255.255.0
Router A(config-if)#encapsulation ppp
Router(config)#hostname Router B
Router B(config)#interface serial 4/0
Router B(config-if)#ip address 172.16.2.2 255.255.255.0
Router B(config-if)#encapsulation ppp
第二步：配置CHAP认证
Router A(config)# username RouterB password 0 123
Router B(config)#username RouterA password 0123
Router B(config)#interface serial 4/0
Router B(config-if)#ppp authentication chap
第三步：验证CHAP认证
Router A#show interfaces serial 4/0
Index(dec):1 (hex):1
serial 4/0 is UP , line protocol is UP
Hardware is Infineon DSCC4 PEB20534 H-10 serial
Interface address is: 172.16.2.1/24
MTU 1500 bytes, BW 2000 Kbit
Encapsulation protocol is PPP, loopback not set
Keepalive interval is 10 sec , set
Carrier delay is 2 sec
RXload is 1 ,Txload is 1
LCP Open
Open: ipcp
Queueing strategy: WFQ
11421118 carrier transitions
V35 DCE cable
DCD=up DSR=up DTR=up RTS=up CTS=up
5 minutes input rate 45 bits/sec, 0 packets/sec
5 minutes output rate 44 bits/sec, 0 packets/sec
889 packets input, 18810 bytes, 0 no buffer, 28 dropped
Received 68 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 abort
848 packets output, 15203 bytes, 0 underruns , 5 dropped
0 output errors, 0 collisions, 28 interface resets
使用debug ppp authentication 命令验证配置。
Router A#debug ppp authentication
Router A#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router A(config)#interface serial 4/0
Router A(config-if)#shutdown
Router A(config-if)#Aug 9 01:46:10 RouterA %7:%LINK CHANGED: Interface serial 4/0, changed state to administratively down
Aug 9 01:46:10 RouterA %7:%LINE PROTOCOL CHANGE: Interface serial 4/0, changed state to DOWN
Router A(config-if)#no shutdown
Router A(config-if)#Aug 9 01:46:22 RouterA %7:PPP: ppp_clear_author(), protocol = LCP
Aug 9 01:46:22 RouterA %7:%LINK CHANGED: Interface serial 4/0, changed state to up
RouterA(config-if)#Aug 9 01:46:38 RouterA %7:PPP: serial 4/0 [I] CHAP CHALLENGE id 17 len 24
Aug 9 01:46:38 RouterA %7:PPP: serial 4/0 recv CHAP challenge from RouterB
Aug 9 01:46:38 RouterA %7:PPP: serial 4/0 Search Password in local.
Aug 9 01:46:38 RouterA %7:PPP: serial 4/0 [I] CHAP CHALLENGE id 18 len 24
Aug 9 01:46:38 RouterA %7:PPP: serial 4/0 recv CHAP challenge from RouterB
Aug 9 01:46:38 RouterA %7:PPP: serial 4/0 Search Password in local.
Aug 9 01:46:38 RouterA %7:PPP: serial 4/0 [I] CHAP SUCCESS id 18 len 0
Aug 9 01:46:38 RouterA %7::PPP: serial 4/0 authentication OK, begin networkphase!
Aug 9 01:46:38 RouterA %7:PPP: ppp_clear_author(), protocol = IPCP
Aug 9 01:46:39 RouterA %7:%LINE PROTOCOL CHANGE: Interface serial 4/0, changed state to UP
【注意事项】
封装广域网协议时，要求V.35线缆的两个端口封装协议一致，否则无法建立链路。
【参考配置】
Router A#show running-config
Building configuration...
Current configuration : 574 bytes
!
version RGNOS 10.1.00(4), Release(18443)(Tue Jul 17 21:16:17 CST 2007 -ubu1server)
hostname Router A
!
username RouterB password 0 123
!
interface serial 4/0
encapsulation PPP
ip address 172.16.2.1 255.255.255.0
clock rate 64000
!
interface serial 4/1
clock rate 64000
!
interface GigabitEthernet 0/0
duplex auto
speed auto
!
interface GigabitEthernet 0/1
duplex auto
speed auto
!
line con 0
line aux 0
line vty 0 4
login
!
end
Router B#show running-config
Building configuration...
Current configuration : 581 bytes
!
version RGNOS 10.1.00(4), Release(18443)(Tue Jul 17 21:16:17 CST 2007 -ubu1server)
hostname Router B
!
username RouterA password 0 123
!
interface serial 4/0
encapsulation PPP
ppp authentication chap
ip address 172.16.2.2 255.255.255.0
!
interface serial 4/1
clock rate 64000
!
interface GigabitEthernet 0/0
duplex auto
speed auto
!
interface GigabitEthernet 0/1
duplex auto
speed auto
!
line con 0
line aux 0
line vty 0 4
login
!
end