网络工程师Day2---实验2-1：HDLC和PPP配置

太过爱你忘了你带给我的痛 2024-04-17 05:23 52阅读 0赞

# 网络工程师Day2—实验2-1：HDLC和PPP配置 #

## 学习目标 ##

### 掌握HDLC的基本配置方法 ###

### 掌握DCE时钟波特率的配置方法 ###

### 掌握PPP的基本配置方法 ###

### 掌握PPP链路的PAP认证的配置方法 ###

### 掌握PPP链路的CHAP认证的配置方法 ###

## 拓扑图 ##

![HDLC和PPP实验拓扑图][HDLC_PPP]

## 场景 ##

您是公司的网络管理员，公司总部有一台路由器R2，R1和R3分别是其他两个分部的路由器。现在您需要将总部网络和分部网络通过广域网连接起来。在广域网链路上尝试使用HDLC和PPP协议，并在使用PPP协议时配置了不同的认证方式保证安全。

## 操作步骤 ##

### 步骤一 实验环境准备 ###

<Huawei>sys
    Enter system view, return user view with Ctrl+Z.
    [R1]un in en
    [Huawei]sysn R1
    Info: Information center is disabled.
    [R1]int s0/0/0
    [R1-Serial0/0/0]ip add 10.0.12.1 24
    [R1-Serial0/0/0]quit

<Huawei>sys
    Enter system view, return user view with Ctrl+Z.
    [Huawei]un in en
    Info: Information center is disabled.
    [Huawei]sysn R2
    [R2]int s0/0/0
    [R2-Serial0/0/0]ip add 10.0.12.2 24
    [R2-Serial0/0/0]int s0/0/1
    [R2-Serial0/0/1]ip add 10.0.23.2 24
    [R2-Serial0/0/1]quit

<Huawei>sys
    Enter system view, return user view with Ctrl+Z.
    [Huawei]un in en
    Info: Information center is disabled.
    [Huawei]sysn R3
    [R3]int s0/0/0
    [R3-Serial0/0/0]ip add 10.0.23.3 24
    [R3-Serial0/0/0]quit

### 步骤二 在串行接口上启用HDLC协议 ###

[R1]int s0/0/0  
    [R1-Serial0/0/0]link-protocol hdlc  
    Warning: The encapsulation protocol of the link will be changed.   
    Continue? [Y/N]:y

[R2]int s0/0/0  
    [R2-Serial0/0/0]link-protocol hdlc  
    Warning: The encapsulation protocol of the link will be changed.   
    Continue? [Y/N]:y  
    [R2-Serial0/0/0]int s0/0/1  
    [R2-Serial0/0/1]link-protocol hdlc  
    Warning: The encapsulation protocol of the link will be changed.   
    Continue? [Y/N]:y

[R3]int s0/0/0    
    [R3-Serial0/0/0]link-protocol hdlc  
    Warning: The encapsulation protocol of the link will be changed.   
    Continue? [Y/N]:y

配置完成后，查看串行接口的状态，以R1上的显示信息为例：

[R1]disp int s0/0/0
    Serial0/0/0 current state : UP
    Line protocol current state : UP
    Last line protocol up time : 2019-08-21 15:12:45 UTC-08:00
    Description:
    Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
    Internet Address is 10.0.12.1/24
    Link layer protocol is nonstandard HDLC
    Last physical up time   : 2019-08-21 15:06:26 UTC-08:00
    Last physical down time : 2019-08-21 15:06:25 UTC-08:00
    Current system time: 2019-08-21 15:15:56-08:00Interface is V35
    Last 300 seconds input rate 2 bytes/sec, 0 packets/sec
    Last 300 seconds output rate 2 bytes/sec, 0 packets/sec
    Input: 2480 bytes, 175 Packets
    Ouput: 2556 bytes, 164 Packets
    Input bandwidth utilization  : 0.02%
    Output bandwidth utilization : 0.02%

确定该接口的物理状态和协议状态均以UP后，检测直连链路的连通性。

<R2>ping 10.0.12.1
    PING 10.0.12.1: 56  data bytes, press CTRL_C to break
    Reply from 10.0.12.1: bytes=56 Sequence=1 ttl=255 time=90 ms
    Reply from 10.0.12.1: bytes=56 Sequence=2 ttl=255 time=30 ms
    Reply from 10.0.12.1: bytes=56 Sequence=3 ttl=255 time=10 ms
    Reply from 10.0.12.1: bytes=56 Sequence=4 ttl=255 time=50 ms
    Reply from 10.0.12.1: bytes=56 Sequence=5 ttl=255 time=50 ms
    
      --- 10.0.12.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
     0.00% packet loss
    round-trip min/avg/max = 10/46/90 ms

## 步骤三 配置OSPF ##

在三台路由器上都启用OSPF路由协议，并发布各自的直连路由

<R1>sys
    Enter system view, return user view with Ctrl+Z.
    [R1]ospf
    [R1-ospf-1]area 0
    [R1-ospf-1-area-0.0.0.0]network 10.0.12.0 0.0.0.255
    [R1-ospf-1-area-0.0.0.0]quit

<R2>sys
    Enter system view, return user view with Ctrl+Z.
    [R2]ospf
    [R2-ospf-1]area 0
    [R2-ospf-1-area-0.0.0.0]network 10.0.12.0 0.0.0.255
    [R2-ospf-1-area-0.0.0.0]network 10.0.23.0 0.0.0.255
    [R2-ospf-1-area-0.0.0.0]quit

<R3>sys
    Enter system view, return user view with Ctrl+Z.
    [R3]ospf
    [R3-ospf-1]area 0
    [R3-ospf-1-area-0.0.0.0]network 10.0.23.0 0.0.0.255
    [R3-ospf-1-area-0.0.0.0]quit
    [R3-ospf-1]quit

当所有的路由都学习到之后，使用R1pingR3测试是否网络联通

[R1]ping 10.0.23.3
    PING 10.0.23.3: 56  data bytes, press CTRL_C to break
    Reply from 10.0.23.3: bytes=56 Sequence=1 ttl=254 time=50 ms
    Reply from 10.0.23.3: bytes=56 Sequence=2 ttl=254 time=80 ms
    Reply from 10.0.23.3: bytes=56 Sequence=3 ttl=254 time=70 ms
    Reply from 10.0.23.3: bytes=56 Sequence=4 ttl=254 time=40 ms
    Reply from 10.0.23.3: bytes=56 Sequence=5 ttl=254 time=40 ms
    
      --- 10.0.23.3 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
      0.00% packet loss
    round-trip min/avg/max = 40/56/80 ms

## 步骤四 管理串口连接 ##

查看串行接口连接的线缆类型、接口状态和时钟频率，并修改时钟频率。

[R1]dis int s0/0/0
    Serial0/0/0 current state : **UP**
    Line protocol current state : **UP**
    ## Last line protocol up time : 2019-08-21 15:12:45 UTC-08:00 ##
    Description:
    Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
    Internet Address is 10.0.12.1/24
    Link layer protocol is nonstandard HDLC
    Last physical up time   : 2019-08-21 15:06:26 UTC-0	8:00
    Last physical down time : 2019-08-21 15:06:25 UTC-08:00
    Current system time: 2019-08-21 21:48:31-08:00Interface is V35
    Last 300 seconds input rate 10 bytes/sec, 0 packets/sec
    Last 300 seconds output rate 10 bytes/sec, 0 packets/sec
    Input: 20792 bytes, 822 Packets
    Ouput: 21164 bytes, 818 Packets
    Input bandwidth utilization  : 0.12%
    Output bandwidth utilization : 0.12%

回显信息表明R1的S0/0/0接口连接的是DCE线缆，时钟频率是64000bit/s。DCE设备可以控制时钟频率和带宽。  
将R1和R2间链路的时钟频率修改为128000bit/s。这一操作需在DCE设备R1上执行。

这个地方发现实验设备没有和指导书中一样。

不能修改端口速率

尝试其他设备特别是书中的R2220 AR2220没有Serical口。

## 步骤五 修改串行接口的封装类型为PPP ##

在R1和R2以及R2和R3间修改串行接口使用PPP封装，链路两端必须配置相同的封装类型，否则接口状态就会出现DOWN的情况

[R1]int s0/0/0
    [R1-Serial0/0/0]link-protocol ppp
    Warning: The encapsulation protocol of the link will be changed. 
    Continue? [Y/N]:y

<R2>sys
    Enter system view, return user view with Ctrl+Z.
    [R2]int s0/0/0
    [R2-Serial0/0/0]link-protocol ppp
    Warning: The encapsulation protocol of the link will be changed. 
    Continue? [Y/N]:y
    [R2-Serial0/0/0]quit
    [R2]link-protocol ppp
    [R2]int s0/0/1
    [R2-Serial0/0/1]link-protocol ppp
    Warning: The encapsulation protocol of the link will be changed. 
    Continue? [Y/N]:y
    [R2-Serial0/0/1]quit

<R3>sys
    Enter system view, return user view with Ctrl+Z.
    [R3]int s0/0/0
    [R3-Serial0/0/0]
    [R3-Serial0/0/0]link-protocol ppp
    Warning: The encapsulation protocol of the link will be changed. 
    Continue? [Y/N]:y
    [R3-Serial0/0/0]quit

配置完成后，检测链路联通性。

[R2]ping 10.0.12.1
      PING 10.0.12.1: 56  data bytes, press CTRL_C to break
    Reply from 10.0.12.1: bytes=56 Sequence=1 ttl=255 time=60 ms
    Reply from 10.0.12.1: bytes=56 Sequence=2 ttl=255 time=50 ms
    Reply from 10.0.12.1: bytes=56 Sequence=3 ttl=255 time=30 ms
    Reply from 10.0.12.1: bytes=56 Sequence=4 ttl=255 time=50 ms
    Reply from 10.0.12.1: bytes=56 Sequence=5 ttl=255 time=40 ms
    
      --- 10.0.12.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 30/46/60 ms
    
    [R2]ping 10.0.23.3
      PING 10.0.23.3: 56  data bytes, press CTRL_C to break
    Reply from 10.0.23.3: bytes=56 Sequence=1 ttl=255 time=30 ms
    Reply from 10.0.23.3: bytes=56 Sequence=2 ttl=255 time=10 ms
    Reply from 10.0.23.3: bytes=56 Sequence=3 ttl=255 time=50 ms
    Reply from 10.0.23.3: bytes=56 Sequence=4 ttl=255 time=1 ms
    Reply from 10.0.23.3: bytes=56 Sequence=5 ttl=255 time=20 ms
    
      --- 10.0.23.3 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 1/22/50 ms

查看端口状态

[R2]dis int s0/0/0 
    Serial0/0/0 current state : UP
    Line protocol current state : UP
    Last line protocol up time : 2019-08-21 22:32:06 UTC-08:00
    Description:
    Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
    Internet Address is 10.0.12.2/24
    Link layer protocol is PPP
    LCP opened, IPCP opened
    Last physical up time   : 2019-08-21 22:32:06 UTC-08:00
    Last physical down time : 2019-08-21 22:32:06 UTC-08:00
    Current system time: 2019-08-21 22:43:45-08:00Interface is V35
    Last 300 seconds input rate 10 bytes/sec, 0 packets/sec
    Last 300 seconds output rate 10 bytes/sec, 0 packets/sec
    Input: 54874 bytes, 1589 Packets
    Ouput: 64946 bytes, 1597 Packets
    Input bandwidth utilization  : 0.12%
    Output bandwidth utilization : 0.12%

## 步骤六 检查路由表项的变化 ##

PPP配置完成后，路由器之间会建立数据链路层的连接。本地路由器会向远端路由器发送一条主机路由，路由信息中包含本地接口的IP地址，掩码为32位。

[R2]dis ip routing-table 
    Route Flags: R - relay, D - download to fib
    ------------------------------------------------------------------------------
    Routing Tables: Public
     Destinations : 8Routes : 8
    
    Destination/MaskProto   Pre  Cost  Flags NextHop Interface
    
      10.0.12.0/24  Direct  00   D   10.0.12.2   Serial0/0/0
      10.0.12.1/32  Direct  00   D   10.0.12.1   Serial0/0/0
      10.0.12.2/32  Direct  00   D   127.0.0.1   Serial0/0/0
      10.0.23.0/24  Direct  00   D   10.0.23.2   Serial0/0/1
      10.0.23.2/32  Direct  00   D   127.0.0.1   Serial0/0/1
      10.0.23.3/32  Direct  00   D   10.0.23.3   Serial0/0/1
      127.0.0.0/8   Direct  00   D   127.0.0.1   InLoopBack0
      127.0.0.1/32  Direct  00   D   127.0.0.1   InLoopBack0

可以看出，路由表中已经包含通往R1和R3的路由，回顾下这两条路由的由来和功能，回答下面两个问题：

如果配置的是HDLC封装，路由表中还会有这两条路由吗

将其改为HDLC封装，其路由表为

[R2]dis ip routing-table 
    Route Flags: R - relay, D - download to fib
    ------------------------------------------------------------------------------
    Routing Tables: Public
     Destinations : 6Routes : 6
    
    Destination/MaskProto   Pre  Cost  Flags NextHop Interface
    
      10.0.12.0/24  Direct  00   D   10.0.12.2   Serial0/0/0
      10.0.12.2/32  Direct  00   D   127.0.0.1   Serial0/0/0
      10.0.23.0/24  Direct  00   D   10.0.23.2   Serial0/0/1
      10.0.23.2/32  Direct  00   D   127.0.0.1   Serial0/0/1
      127.0.0.0/8   Direct  00   D   127.0.0.1   InLoopBack0
      127.0.0.1/32  Direct  00   D   127.0.0.1   InLoopBack0

如果R1和R2上的S1/0/0接口IP地址不在同一网段，它们之间还能够通过HDLC或者PPP通信吗？

[R1]ping 10.0.22.1 
      PING 10.0.22.1: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out
    
      --- 10.0.22.1 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss

## 步骤七 在R1和R2间的PPP链路启用PAP认证功能 ##

配置PAP认证功能，并将R1配置为PAP认证方。

[R1]interface s0/0/0
    [R1-Serial0/0/0]ppp authentication-mode pap
    [R1-Serial0/0/0]quit
    [R1]display interface s0/0/0
    Serial0/0/0 current state : UP
    Line protocol current state : UP
    Last line protocol up time : 2019-08-21 23:13:29 UTC-08:00
    Description:
    Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
    Internet Address is 10.0.12.1/24
    Link layer protocol is PPP
    LCP opened, IPCP opened
    Last physical up time   : 2019-08-21 23:13:14 UTC-08:00
    Last physical down time : 2019-08-21 23:13:13 UTC-08:00
    Current system time: 2019-08-21 23:14:01-08:00Interface is V35
    Last 300 seconds input rate 7 bytes/sec, 0 packets/sec
    Last 300 seconds output rate 10 bytes/sec, 0 packets/sec
    Input: 80612 bytes, 2000 Packets
    Ouput: 84272 bytes, 2057 Packets
    Input bandwidth utilization  : 0.08%
    Output bandwidth utilization : 0.12%

将R2配置为PAP的被认证方

[R2-Serial0/0/0]ppp pap local-user huawei password cipher huawei123
    [R2-Serial0/0/0]quit
    [R2]dis int s0/0/0
    Serial0/0/0 current state : UP
    Line protocol current state : UP
    Last line protocol up time : 2019-08-21 23:13:29 UTC-08:00
    Description:
    Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
    Internet Address is 10.0.12.2/24
    Link layer protocol is PPP
    LCP opened, IPCP opened
    Last physical up time   : 2019-08-21 23:13:28 UTC-08:00
    Last physical down time : 2019-08-21 23:13:27 UTC-08:00
    Current system time: 2019-08-21 23:16:38-08:00Interface is V35
    Last 300 seconds input rate 11 bytes/sec, 0 packets/sec
    Last 300 seconds output rate 11 bytes/sec, 0 packets/sec
    Input: 85712 bytes, 2102 Packets
    Ouput: 82142 bytes, 2047 Packets
    Input bandwidth utilization  : 0.13%
    Output bandwidth utilization : 0.13%

配置完成后，检测R1和R2间的连通性，并通过debug功能观察PAP认证报文的交互

<R1>debugging ppp pap packet 
    <R1>terminal debugging 
    Info: Current terminal debugging is on.
     PPP Packet: 
      Serial0/0/0 Input  PAP(c023) Pkt, Len 25 
      State ServerListen, code Request(01), id 1, len 21 
      Host Len:  6  Name:huawei 
      Pwd Len:  9  Pwd:huawei123
      <R1>undo debugging all

## 步骤八 在R2和R3间的PPP链路上启用CHAP认证功能 ##

将R3配置为CHAP的认证方

[R3-Serial0/0/0]ppp authentication-mode chap
    [R3-Serial0/0/0]quit
    [R3]aaa
    [R3-aaa]local-user huawei password cipher huawei123
    Info: Add a new user.
    [R3-aaa]local-user huawei service-type ppp
    [R3-aaa]quit

将R2的S0/0/1接口配置成被认证方

[R2-Serial0/0/1]ppp chap user huawei
    [R2-Serial0/0/1]ppp chap password cipher huawei123

使用R2进行链路的测试

[R2]ping 10.0.23.3
      PING 10.0.23.3: 56  data bytes, press CTRL_C to break
    Reply from 10.0.23.3: bytes=56 Sequence=1 ttl=255 time=50 ms
    Reply from 10.0.23.3: bytes=56 Sequence=2 ttl=255 time=50 ms
    Reply from 10.0.23.3: bytes=56 Sequence=3 ttl=255 time=30 ms
    Reply from 10.0.23.3: bytes=56 Sequence=4 ttl=255 time=50 ms
    Reply from 10.0.23.3: bytes=56 Sequence=5 ttl=255 time=10 ms
    
      --- 10.0.23.3 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 10/38/50 ms

## 步骤九 使用debug命令查看R2和R3之间使用CHAP建立PPP连接的协商过程 ##

查看R2与R3建立ppp连接时的协商情况，为了看到完整的协商过程，需要先关闭R2的S0/0/1接口，然后启动debug命令，再打开接口，就可以看到完整的协商过程。

首先关闭R2的S0/0/1接口。

[R2-Serial0/0/1]shutdown

为了避免S0/0/0接口信息对我们的干扰，此时也可关闭S0/0/0

[R2-Serial0/0/0]shutdown

执行debugging ppp chap all 和terminal debugging 命令，查看debug信息。

<R2>debugging ppp chap all
    <R2>terminal debugging 
    Info: Current terminal debugging is on.
    <R2>display debugging
    PPP CHAP packets debugging switch is on
    PPP CHAP events debugging switch is on
    PPP CHAP errors debugging switch is on
    PPP CHAP state change debugging switch is on

打开R2的物理接口S0/0/1，发起认证

[R2-Serial0/0/1]un shutdown

此时可以看到相应的debug信息流出

PPP State Change: 
      Serial0/0/1 CHAP : Initial --> ListenChallenge 
    Aug 21 2019 23:41:55.130.4-08:00 R2 PPP/7/debug2:
      PPP Packet: 
      Serial0/0/1 Input  CHAP(c223) Pkt, Len 25 
      State ListenChallenge, code Challenge(01), id 1, len 21 
      Value_Size:  16  Value: f2 47 48 13 d9 66 37 2a af 4f f6 3f 34 39 90 29 
      Name: 
    Aug 21 2019 23:41:55.130.5-08:00 R2 PPP/7/debug2:

## 附加练习 ##

## 为什么PPP中CHAP认证比PAP认证的安全性更高？ ##

链接：https://www.nowcoder.com/questionTerminal/23017970388842c4b3181f37da7e085d?toCommentId=622758  
来源：牛客网

PAP：密码口令验证协议，全称：Password Authentication Protocol。PAP是两次握手认证协议，在链路首次初始化时，被认证端首先发起认证请求，向认证端发送用户名和密码信息进行身份认证。密码口令以明文发送，所以安全性较低。 CHAP：挑战握手认证协议，全称：Challenge Handshake Authentication Protocol。CHAP通过三次握手验证被认证端的身份，在初始链路建立时完成，为了提高安全性，在链路建立之后周期性进行验证。CHAP比PAP更安全，因为CHAP不在线路上发送明文，而是发送经过MD5过的随机数序列。

[HDLC_PPP]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/11/f5db81b366094041a0b1816a7a1a4398.png