实验八PPP与广域网链路测试综述

1、一、实验目标1、 掌握PPP的基本配置。掌握广域网链路通信质量测试方式。2、 理解PPP协商过程，PAP/CHAP认证过程，掌握 PPP调试3、 掌握PPP Multilink的配置及测试。二、实验拓扑RT1S0I0RT3SOA)10.10.13.1/3010.10J3.2Z30三、实验内容1、基本信息配置RT1Routere nable/进入全局模式Router#c on figure term inal/进入特权模式Router(config)#hostname RT1/命名主机名RT1(c on fig)# no ip doma in lookup禁用域名查找RT1(co nfig)#l

2、 ine con sole 0进入con sole线口RT1(c on fig-li ne)#logg ing synchronous/自动换行RT1(c on fig-l in e)# no log in/配置登陆不需要认证RT1(config-line)#privilege level 15/配置con sole为最高权限RT1(con fig-li ne)#exec-timeout 0/配置超时为 0RT1(config-line)#exit/退出线口RT1(config)#line vty 04 /进入线口RT1(config-line)#no login /配置登陆不需要认证 RT1

3、(config-line)#privilege level 15 /配置该线口为最高权限 RT1(config-line)#exit /退出线口RT3RouterenableRouter#configure terminal Router(config)#hostname RT3 RT3(config)#no ip domain lookup RT3(config)#line console 0 RT3(config-line)#logging synchronous RT3(config-line)#no login RT3(config-line)#privilege level 15 R

4、T3(config-line)#exec-timeout 0 RT3(config-line)#exit RT3(config)#line vty 04 RT3(config-line)#no login RT3(config-line)#privilege level 15 RT3(config-line)#exit 2、 PPP 基本配置RT1(config)#interface serial 0/0/进入接口RT1(config-if)#clock rate 1000000/配置 DCE 端时钟频率RT1(config-if)#encapsulation ppp/配置数据链路层封装协议R

5、T1(config-if)#ip address 10.10.13.1 255.255.255.0/配置 ip 地址RT1(config-if)#no shutdown/打开接口RT1(config-if)#exit/退出接口RT3(config)#interface serial 0/0/进入接口RT3(config-if)#encapsulation ppp/配置数据链路层封装协议RT3(config-if)#ip address 10.10.13.2 255.255.255.0/配置 ip 地址RT3(config-if)#no shutdown/打开接口RT3(config-if)#e

6、xit/退出接口3、 RT1 RT3 广域网链路通信质量测试RT3#ping 10.10.13.1 size 46 repeat 1000/小包测试Type escape sequence to abort.Sending 1000, 46-byte ICMP Echos to 10.10.13.1, timeout is 2 seconds: !Success rate is 100 percent (1000/1000), round-trip min/avg/max = 4/16/64 ms 无丢包RT3#ping 10.10.13.1 size 8100 repeat 1000/大包测

7、试Type escape sequence to abort.Sending 1000, 8100-byte ICMP Echos to 10.10.13.1, timeout is 2 seconds: !Success rate is 100 percent (1000/1000), round-trip min/avg/max = 16/67/148 ms 无丢包RT3#ping 10.10.13.1 size 1500 df-bit repeat 1000/满 MTU 测试Type escape sequence to abort.Sending 1000, 1500-byte ICM

8、P Echos to 10.10.13.1, timeout is 2 seconds:Packet sent with the DF bit set !Success rate is 100 percent (1000/1000), round-trip min/avg/max = 4/15/72 ms 无丢包4、 PPP 自动获取 IP 地址调试RT1(config)#ip local pool ppp-ip-pool 10.10.1.11 10.10.1.200/配置 ip 地址池RT1(config)#interface serial 0/0/进入接口RT1(config-if)#no

9、 ip address/清除上步配置的 ip 地址RT1(config-if)#ip address 10.10.1.1 255.255.255.0RT1(config-if)#peer default ip address pool ppp-ip-pool/对端 DTE 缺失 ip 地址从此 ip 地址池获取RT1(config-if)#ppp ipcp dns 202.103.96.68/配置 DNS 服务器RT1(config-if)#exit /退出接口RT3(config)#interface serial 0/0 /进入接口RT3(config-if)#shutdown/关闭接口R

10、T3(config-if)#no ip address/清除 ip 地址，此步是为了去掉 ip 地址后自动获取RT3(config-if)#ip address negotiated/启用 ip 地址自动协商RT3(config-if)#ppp ipcp dns request/启用 DNS 自动协商RT3(config-if)#exit/退出接口5、 IPCP 获取 IP 地址调试/在 RT3 上打开 debug ppp negotiation ，然后将 serial0/0 打开，查看协商过程RT3#debug ppp negotiation/启用PPP ip地址协商PPP protocol

11、 negotiation debugging is onRT3#configure terminalRT3(config)#interface serial 0/0RT3(config-if)#no shutdown*Mar 1 00:46:53.315: Se0/0 IPCP: I CONFNAK ACKsent id 2 len 16*Mar1 00:46:53.315: Se0/0 IPCP:Address 10.10.1.11 (0x03060A0A010B)*Mar1 00:46:53.315: Se0/0 IPCP:PrimaryDNS 202.103.96.68 (0x8106C

12、A676044)*Mar 1 00:46:53.315: Se0/0 IPCP: O CONFREQ ACKsent id 3 len 16*Mar1 00:46:53.315: Se0/0 IPCP:Address 10.10.1.11 (0x03060A0A010B)*Mar1 00:46:53.315: Se0/0 IPCP:PrimaryDNS 202.103.96.68 (0x8106CA676044)*Mar 1 00:46:53.323: Se0/0 IPCP: I CONFACK ACKsent id 3 len 16*Mar 1 00:46:53RT3(config-if)#

13、.323: Se0/0 IPCP:Address 10.10.1.11 (0x03060A0A010B)*Mar 1 00:46:53.323: Se0/0 IPCP: PrimaryDNS 202.103.96.68 (0x8106CA676044)*Mar 1 00:46:53.323: Se0/0 IPCP: State is Open*Mar 1 00:46:53.323: Se0/0 IPCP: Install negotiated IP interface address 10.10.1.11*Mar 1 00:46:53.335: Se0/0 IPCP: Install rout

14、e to 10.10.1.1*Mar 1 00:46:53.351: Se0/0 IPCP: Add link info for cef entry 10.10.1.1*Mar 1 00:46:54.255: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to upRT3#undebug all/关闭调试Port Statistics for unclassified packets is not turned on.All possible debugging has been turned

15、offRT3#show ip interface brief/查看端口信息InterfaceIP-AddressOK? Method StatusProtocolSerial0/010.10.1.11YES IPCP upup6、PPP PAP单向认证调试本步目的：PPP PAP单向认证成功,RT1 、RT3 相连接口 UP1)认证方配置RT1(config)#username usera password passa /配置用户数据库RT1(config)#interface serial 0/0/进入接口RT1(config-if)#no ip address/清除 ip 地址RT1(co

16、nfig-if)#no peer default ip address/关闭 ip 地址自动获取RT1(config-if)#no ppp ipcp dns/关闭 DNS 自动获取RT1(config-if)#ip address 10.10.12.1 255.255.255.252RT1(config-if)#ppp authentication pap/启用 PAP 认证RT3(config)#interface serial 0/0/进入接口RT3(config-if)#shutdown/关闭端口RT3(config-if)#no ip address negotiated/关闭 ip

17、地址自动协商RT3(config-if)#no ppp ipcp dns/关闭 DNS 自动获取 RT3(config-if)#ip address 10.10.12.2 255.255.255.252RT3(config-if)#ppp pap sent-username usera password passa/配置 PAP 用于认证的用户名和密码(3)PAP 单向认证调试/在 RT1 上打开 debug ppp authentication ，将 RT3 的 serial0/0 打开，查看调试信息RT1#debug ppp authentication/ PPP 认证调试PPP auth

18、entication debugging is onRT3#debug ppp authentication/ PPP 认证调试PPP authentication debugging is onRT3#configure terminalRT3(config)#interface serial 0/0RT3(config-if)#no shutdown*Mar 1 01:15:51.523: %LINK-3-UPDOWN: Interface Serial0/0, changed state to up*Mar 1 01:15:51.527: Se0/0 PPP: Using default

19、 call direction*Mar 1 01:15:51.531: Se0/0 PPP: Treating connection as a dedicated line*Mar 1 01:15:51.531: Se0/0 PPP: Session handleE3000003 Session id4*Mar 1 01:15:51.535: Se0/0 PPP: Authorization required*Mar 1 01:15:51.603: Se0/0 PPP: No authorization without authentication*Mar 1 01:15:51.607: Se

20、0/0 PAP: Using hostname from interface PAP *Mar 1 01:15:51.607: Se0/0 PAP: Using password from interface PAP*Mar 1 01:15:51.611: Se0/0 PAP: O AUTH-REQ id 1 len 16 from usera*Mar 1 01:15:51.671: Se0/0 PAP: I AUTH-ACK id 1 len 5*Mar 1 01:15:52.675: %LINEPROTO-5-UPDOWN: Line protocol on Interface Seria

21、l0/0, changed state to upRT1#undebug allRT3#undebug all( 4)过程分析：由被认证方发起，RT3将自己的用户名(usera)和密码(passa)发送给认证方RT1, RT1收到后，查用户数据库，发现数据库中有对应条目回复认证通7、 PPP CHAP 单向认证( 1 )认证方配置RT1(config)#no username usera/清除上步的用户数据库RT1(config)#interface serial 0/0/进入接口RT1(config-if)#no ppp authentication/关闭 PPP 调试RT1(config-

22、if)#exit/退出接口RT1(config)#username usera password passa/配置用户数据库RT1(config)#interface serial 0/0/进入接口RT1(config-if)#ppp authentication chap/启用 CHAP 认证( 2)被认证方配置RT3(config)#interface serial 0/0/进入接口RT3(config-if)#shutdown /关闭端口RT3(config-if)#no ppp pap sent-username/清除上步 PAP 认证用户名RT3(config-if)#ppp cha

23、p hostname usera/配置 CHAP 认证默认用户名，用于发送给主认证方的RT3(config-if)#ppp chap password passa/配置默认密码(3) CHAP 单向认证调试RT1#debug ppp authentication/PPP 认证调试PPP authentication debugging is onRT3#debug ppp authentication/PPP 认证调试PPP authentication debugging is onRT3(config)#interface serial 0/0/进入接口RT3(config-if)#no

24、shutdown/打开接口*Mar 1 01:51:55.887: %LINK-3-UPDOWN: Interface Serial0/0, changed state to up*Mar 1 01:51:55.891: Se0/0 PPP: Using default call direction*Mar 1 01:51:55.895: Se0/0 PPP: Treating connection as a dedicated line*Mar 1 01:51:55.895: Se0/0 PPP: Session handleB9000004 Session id5*Mar 1 01:51:

25、55.899: Se0/0 PPP: Authorization required*Mar 1 01:51:55.963: Se0/0 PPP: No authorization without authentication*Mar 1 01:51:55.975: Se0/0 CHAP: I CHALLENGE id 1 len 24 from RT1*Mar 1 01:51:55.983: Se0/0 CHAP: Using hostname from interface CHAP*Mar 1 01:51:55.987: Se0/0 CHAP: Using password from int

26、erface CHAP*Mar 1 01:51:55.987: Se0/0 CHAP: O RESPONSE id 1 len 26 from usera*Mar 1 01:51:56.027: Se0/0 CHAP: I SUCCESS id 1 len 4*Mar 1 01:51:57.031: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to upRT1#show ip interface briefInterface IP-AddressOK? Method StatusProtoco

27、lSerial0/010.10.12.1YES manual upupRT3#show ip interface briefInterfaceIP-AddressOK? Method StatusProtocolSerial0/010.10.12.2YES manual upupRT1#undebug allRT3#undebug all4）、认证过程分析由认证方发起认证，认证方RT1 发送挑战信息，挑战信息包括：01， ID ，随机数，用户名RT1被认证方 RT3 收到挑战信息后，根据收到的用户名查找用户数据库，发现没有对应项，使用默认密码， RT3 根据 ID，随机数，和密码用 MD5 算

28、法生成 hash 值，然后回复RT1,回复信息包括：02， ID ，HASH 值，用户名useraRT1 收到回复信息后，根据RT3 发过来的用户名，查找用户数据库，根据ID，保存的随机数，和查找到的密码，经过MD5 算法生成 HASH 值，与 RT3 发过来的HASH 值比较，相同， RT1 回复认证通过8、PPP PAP 双向认证调试1 ) RT1RT1(config)#no username usera/清除上不用户数据库RT1(config)#interface serial 0/0/进入接口RT1(config-if)#no ppp authentication /关闭 PPP 调试

29、RT1(config-if)#exit /退出接口RT1(config)#username usera password passa/配置用户数据库RT1(config)#interface serial 0/0/进入接口RT1(config-if)#ppp authentication pap/启用 PAP 认证RT1(config-if)#ppp pap sent-username userb password passb/配置用于认证的用户名和密码(2)RT3RT3(config)#interface serial 0/0/进入接口RT3(config-if)#shutdown/关闭接口

30、RT3(config-if)#no ppp chap hostname/清除上步 CHAP 默认主机名RT3(config-if)#no ppp chap password/清除上步 CHAP 默认密码RT3(config-if)#exit/退出接口RT3(config)#username userb password passb/配置用户数据库RT3(config)#interface serial 0/0/进入接口RT3(config-if)#ppp authentication pap/启用 PAP 认证RT3(config-if)#ppp pap sent-username usera

31、 password passa /配置用于认证的用户名和密码（3） PAP 双向认证调试RT1#debug ppp authentication/启用 PPP 调试PPP authentication debugging is onRT3#debug ppp authentication/在 RT3 上启用 PPP 调试PPP authentication debugging is onRT3(config)#interface serial 0/0RT3(config-if)#no shutdown*Mar 1 02:25:44.423: %LINK-3-UPDOWN: Interface

32、Serial0/0, changed state to up*Mar 1 02:25:44.427: Se0/0 PPP: Using default call direction*Mar 1 02:25:44.431: Se0/0 PPP: Treating connection as a dedicated line*Mar 1 02:25:44.431: Se0/0 PPP: Session handle6F000005 Session id6*Mar 1 02:25:44.435: Se0/0 PPP: Authorization required*Mar 1 02:25:44.503

33、: Se0/0 PAP: Using hostname from interface PAP*Mar 1 02:25:44.503: Se0/0 PAP: Using password from interface PAP*Mar 1 02:25:44.507: Se0/0 PAP: O AUTH-REQ id 2 len 16 from usera*Mar 1 02:25:44.531: Se0/0 PAP: I AUTH-REQ id 1 len 16 from userb*Mar 1 02:25:44.531: Se0/0 PAP: Authenticating peer userb*M

34、ar 1 02:25:44.539: Se0/0 PPP: Sent PAP LOGIN Request*Mar 1 02:25:44.539: Se0/0 PPP: Received LOGIN Response PASS*Mar 1 02:25:44.543: Se0/0 PPP: Sent LCP AUTHOR Request*Mar 1 02:25:44.547: Se0/0 PPP: Sent IPCP AUTHOR Request*Mar 1 02:25:44.555: Se0/0 LCP: Received AAA AUTHOR Response PASS*Mar 1 02:25

35、:44.559: Se0/0 IPCP: Received AAA AUTHOR Response PASS*Mar 1 02:25:44.563: Se0/0 PAP: O AUTH-ACK id 1 len 5*Mar 1 02:25:44.567: Se0/0 PAP: I AUTH-ACK id 2 len 5*Mar 1 02:25:44.575: Se0/0 PPP: Sent CDPCP AUTHOR Request*Mar 1 02:25:44.583: Se0/0 CDPCP: Received AAA AUTHOR Response PASS*Mar 1 02:25:44.

36、607: Se0/0 PPP: Sent IPCP AUTHOR Request*Mar 1 02:25:45.567: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to upRT1#show ip interface briefInterfaceIP-AddressOK? Method StatusProtocolSerial0/010.10.12.1YES manual upupRT3#show ip interface briefInterfaceIP-AddressOK? Method

37、 StatusProtocolSerial0/010.10.12.2YES manual upupRT1#undebug allRT3#undebug all(4)认证过程分析1、RT1将自己的用户名(userb)和密码(passb)发送给 RT3, RT3收到后，查用户数据 库，发现数据库中有对应条目，回复认证通过2、 RT3将自己的用户名(usera)和密码(passa发送给认证方 RT1，RT1收到后，查用户 数据库，发现数据库中有对应条目,回复认证通过3、当有一方认证不通过时，链路将不能建立连接，进行双向认证时，认证方与被认证方是 相对的9、 PPP CHAP 双向认证配置与调试( 1

38、 ) RT1RT1(config)#no username usera/清除上步用户数据库RT1(config)#interface serial 0/0/进入接口RT1(config-if)#no ppp authentication/关闭 PPP 调试RT1(config-if)#no ppp pap sent-username/清除上步 PAP 认证用户名RT1(config-if)#exit/退出接口RT1(config)#interface serial 0/0/进入接口RT1(config-if)#ppp authentication chap/启用 CHAP 认证RT1(conf

39、ig-if)#ppp chap hostname RTA/配置 CHAP 默认用户名RT1(config-if)#exit/退出接口RT1(config)#username RTB password passab/配置用户数据库RT3(config)#no username userb/清除上步用户数据库RT3(config)#interface serial 0/0/接入接口RT3(config-if)#shutdown/关闭端口RT3(config-if)#no ppp authentication/关闭 PPP 认证调试RT3(config-if)#no ppp pap sent-use

40、rname/清除上步 PAP 用于认证的用户名RT3(config-if)#exit/退出接口RT3(config)#interface serial 0/0/进入接口RT3(config-if)#ppp authentication chap/启用 CHAP 认证RT3(config-if)#ppp chap hostname RTB/配置 CHAP 认证默认用户名RT3(config-if)#exit/退出接口RT3(config)#username RTA password passab/配置用户数据库(2) CHAP 认证调试RT1#debug ppp authenticationPP

41、P authentication debugging is onRT3#debug ppp authenticationPPP authentication debugging is onRT3(config)#interface serial 0/0RT3(config-if)#no shutdown*Mar 1 02:37:44.919: %LINK-3-UPDOWN: Interface Serial0/0, changed state to up*Mar 1 02:37:44.923: Se0/0 PPP: Using default call direction*Mar 1 02:3

42、7:44.927: Se0/0 PPP: Treating connection as a dedicated line*Mar 1 02:37:44.927: Se0/0 PPP: Session handleF0000006 Session id7*Mar 1 02:37:44.931: Se0/0 PPP: Authorization required*Mar 1 02:37:44.963: Se0/0 CHAP: O CHALLENGE id 1 len 24 from RTB*Mar 1 02:37:45.015: Se0/0 CHAP: I CHALLENGE id 2 len 2

43、4 from RTA*Mar 1 02:37:45.019: Se0/0 CHAP: I RESPONSE id 1 len 24 from RTA*Mar 1 02:37:45.027: Se0/0 CHAP: Using hostname from interface CHAP*Mar 1 02:37:45.027: Se0/0 CHAP: Using password from AAA*Mar 1 02:37:45.027: Se0/0 CHAP: O RESPONSE id 2 len 24 from RTB*Mar 1 02:37:45.031: Se0/0 PPP: Sent CH

44、AP LOGIN Request*Mar 1 02:37:45.031: Se0/0 PPP: Received LOGIN Response PASS*Mar 1 02:37:45.031: Se0/0 PPP: Sent LCP AUTHOR Request*Mar 1 02:37:45.035: Se0/0 PPP: Sent IPCP AUTHOR Request*Mar 1 02:37:45.043: Se0/0 LCP: Received AAA AUTHOR Response PASS*Mar 1 02:37:45.043: Se0/0 IPCP: Received AAA AU

45、THOR Response PASS*Mar 1 02:37:45.043: Se0/0 CHAP: O SUCCESS id 1 len 4*Mar 1 02:37:45.083: Se0/0 CHAP: I SUCCESS id 2 len 4 *Mar 1 02:37:45.091: Se0/0 PPP: Sent CDPCP AUTHOR Request*Mar 1 02:37:45.099: Se0/0 PPP: Sent IPCP AUTHOR Request*Mar 1 02:37:45.111: Se0/0 CDPCP: Received AAA AUTHOR Response

46、 PASS*Mar 1 02:37:46.083: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to upRT1#show ip interface briefInterfaceIP-AddressOK? Method StatusProtocolSerial0/010.10.12.1YES manual upupRT3#show ip interface briefInterfaceIP-AddressOK? Method StatusProtocolSerial0/010.10.12.2Y

47、ES manual upupSerial0/1unassignedYES unsetadministratively down down（3）认证过程分析1、RT1 发送挑战信息，挑战信息包括：01， ID ，随机数，用户名 RTART3 收到挑战信息后，根据收到的用户名查找用户数据库，发现有对应项，密码（passb），RT3根据ID，随机数，和密码用 MD5算法生成hash值，然后回复给 RT1,回复信息包括： 02， ID， HASH 值，用户名 RTBRT1收到回复信息后，根据 RT3发过来的用户名，查找用户数据库，根据 ID，保存的随机 数，和查找到的密码（passb）,经过MD5算法

48、生成HASH值，与RT3发过来的HASH值比 较，相同， RT1 回复认证通过2、RT3 发送挑战信息，挑战信息包括：01，ID，随机数，用户名 RTB被认证方 RT1 收到挑战信息后，根据收到的用户名查找用户数据库，发现有对应项，密码（passb）, RT1根据ID，随机数，和密码用 MD5算法生成hash值，然后回复 RT3,回复信 息包括：02， ID， HASH 值，用户名 RTBRT3收到回复信息后，根据 RT1发过来的用户名，查找用户数据库，根据ID，保存的随机 数，和查找到的密码(passb),经过MD5算法生成HASH值，与RT3发过来的HASH值比 较，相同， RT3 回复认

49、证通过3、当有一方认证不通过时，链路将不能建立连接，进行双向认证时，认证方与被认证方是相对的、10、 PPP Multilink 配置与调试此步骤将前面配置信息全部清空(1) RT1 与 RT3 的基本信息配置(与第一步基本信息配置相同，不再贴出来) 实验拓扑( 2) PPP Multilink 配置RT1RT1(config)#interface multilink 1/创建链路组 1RT1(config-if)#ppp multilink/启用 PPP 多链路协议RT1(config-if)#ppp multilink group 1RT1(config-if)#ip address 10.10.12.1 255.255.255.252RT1(confi