HCIP实验二：MGRE综合实验

一、实验要求

1，R5为ISP，只能进行IP地址配置;其所有地址均配为公有IP地址
2，R1和R5间使用PPP的PAP认证，R5为主认证方;
   R2于R5之间使用PPP的chap认证，R5为主认证方; 
   R3于R5之间使用HDLC封装。
3，R1/R2/R3构建一个MGRE环境，R1为中心站点;R1、R4间为点到点的GRE。
4， 整个私有网络基于RIP全网可达 
5，所有PC设置私有Ip为源IP，可以访问R5环回。

二、实验目的

1、掌握ppp的PAP认证

2、掌握ppp的CHAP认证

3、学会HDLC封装

三、实验步骤

1、拓扑

2、需求分析

（1）首先配置公网部分

（2）配置私网部分ip地址

（3）添加缺省路由，指向运营商，实现全网可达

（4）R1/R2/R3构建一个MGRE环境，R1为中心站点

（5）R1、R4间为点到点的GRE

（6）整个私有网络基于RIP全网可达 

（7）配置PC

（8）所有PC设置私有Ip为源IP，可以访问R5环回（NAT）

3、配置

（1）首先配置公网部分

修改AR1和AR5之间的认证

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname r1
[r1]int Serial 4/0/0
[r1-Serial4/0/0]ip address 15.1.1.1 24
Mar 28 2024 19:17:08-08:00 r1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol PPP
 IPCP on the interface Serial4/0/0 has entered the UP state. 
[r1-Serial4/0/0]q

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname r5
[r5]int Serial 3/0/0
[r5-Serial3/0/0]ip address 15.1.1.2 24
Mar 28 2024 19:17:08-08:00 r5 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol PPP
 IPCP on the interface Serial3/0/0 has entered the UP state. 
[r5-Serial3/0/0]q

认证方R5的配置：1、在AAA中创建用户名和密码  2、开启PAP认证

[r5]aaa
[r5-aaa]local-user admin password cipher 123456		
[r5-aaa]local-user admin service-type ppp
[r5-aaa]q
[r5]int Serial 3/0/0
[r5-Serial3/0/0]ppp authentication-mode pap
[r5-Serial3/0/0]q

被认证方R1的配置

[r1]int Serial 4/0/0
[r1-Serial4/0/0]ppp pap local-user admin password cipher 123456
[r1-Serial4/0/0]q

修改AR2和AR5之间的认证

认证方R5的配置 ：开启 CHAP认证

[r5]int Serial 3/0/1
[r5-Serial3/0/1]ip address 25.1.1.2 24
[r5-Serial3/0/1]ppp authentication-mode chap
[r5-Serial3/0/1]q

被认证方R2的配置

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname r2	
[r2]int Serial 4/0/0
[r2-Serial4/0/0]ip address 25.1.1.1 24
Mar 28 2024 19:27:02-08:00 r2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol PPP
 IPCP on the interface Serial4/0/0 has entered the UP state. 
[r2-Serial4/0/0]ppp chap user admin
[r2-Serial4/0/0]ppp chap password cipher 123456
[r2-Serial4/0/0]q

 R3于R5之间使用HDLC封装：修改接口二层封装协议

[r5]int Serial 4/0/0
[r5-Serial4/0/0]ip address 35.1.1.2 24	
[r5-Serial4/0/0]link-protocol hdlc
Warning: The encapsulation protocol of the link will be changed. Continue? [Y/N]
:y

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname r3
[r3]int Serial 4/0/0
[r3-Serial4/0/0]ip address 35.1.1.1 24
[r3-Serial4/0/0]link-protocol hdlc
Warning: The encapsulation protocol of the link will be changed. Continue? [Y/N]
:y

 R4和R5之间的配置

[r5]int GigabitEthernet 0/0/0
[r5-GigabitEthernet0/0/0]ip address 45.1.1.2 24
Mar 28 2024 19:35:04-08:00 r5 %%01IFNET/4/LINK_STATE(l)[10]:The line protocol IP
 on the interface GigabitEthernet0/0/0 has entered the UP state.

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname r4
[r4]int GigabitEthernet 0/0/0
[r4-GigabitEthernet0/0/0]ip address 45.1.1.1 24
Mar 28 2024 19:36:49-08:00 r4 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP 
on the interface GigabitEthernet0/0/0 has entered the UP state. 

添加R5的环回地址

[r5]int LoopBack 0
[r5-LoopBack0]ip address 5.5.5.5 24
[r5-LoopBack0]q

（2）配置私网部分ip地址

[r1]int GigabitEthernet 0/0/0
[r1-GigabitEthernet0/0/0]ip address 192.168.1.1 24
Mar 28 2024 19:40:38-08:00 r1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP 
on the interface GigabitEthernet0/0/0 has entered the UP state. 
[r1-GigabitEthernet0/0/0]q

[r2]int GigabitEthernet 0/0/0
[r2-GigabitEthernet0/0/0]ip address 192.168.2.1 24
Mar 28 2024 19:41:44-08:00 r2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP 
on the interface GigabitEthernet0/0/0 has entered the UP state. 
[r2-GigabitEthernet0/0/0]q

[r3]int GigabitEthernet 0/0/0
[r3-GigabitEthernet0/0/0]ip address 192.168.3.1 24
Mar 28 2024 19:42:38-08:00 r3 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP 
on the interface GigabitEthernet0/0/0 has entered the UP state. 
[r3-GigabitEthernet0/0/0]q

[r4]int GigabitEthernet 0/0/1
[r4-GigabitEthernet0/0/1]ip address 192.168.4.1 24
Mar 28 2024 19:43:35-08:00 r4 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP 
on the interface GigabitEthernet0/0/1 has entered the UP state. 
[r4-GigabitEthernet0/0/1]q

（3）添加缺省路由，指向运营商，实现全网可达

[r1]ip route-static 0.0.0.0 0 15.1.1.2

[r2]ip route-static 0.0.0.0 0 25.1.1.2

[r3]ip route-static 0.0.0.0 0 35.1.1.3

[r4]ip route-static 0.0.0.0 0 45.1.1.2

（4）R1/R2/R3构建一个MGRE环境，R1为中心站点

1）创建隧道接口 2）配置IP地址  3）定义封装方式  4）定义封装内容  5）配置NHRP

[r1]int Tunnel 0/0/1
[r1-Tunnel0/0/1]ip address 10.1.2.1 24
[r1-Tunnel0/0/1]tunnel-protocol gre p2mp	
[r1-Tunnel0/0/1]source 15.1.1.1
Mar 28 2024 19:48:08-08:00 r1 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP 
on the interface Tunnel0/0/1 has entered the UP state. 
[r1-Tunnel0/0/1]nhrp entry multicast dynamic 
[r1-Tunnel0/0/1]nhrp network-id 100
[r1-Tunnel0/0/1]q

[r2]int Tunnel 0/0/0
[r2-Tunnel0/0/0]ip address 10.1.2.2 24
[r2-Tunnel0/0/0]tunnel-protocol gre p2mp	
[r2-Tunnel0/0/0]source Serial 4/0/0
Mar 28 2024 19:52:06-08:00 r2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP 
on the interface Tunnel0/0/0 has entered the UP state. 
[r2-Tunnel0/0/0]nhrp network-id 100
[r2-Tunnel0/0/0]nhrp entry 10.1.2.1 15.1.1.1 register
[r2-Tunnel0/0/0]q

[r3]int Tunnel 0/0/0
[r3-Tunnel0/0/0]ip address 10.1.2.3 24
[r3-Tunnel0/0/0]tunnel-protocol gre p2mp
[r3-Tunnel0/0/0]source Serial 4/0/0
Mar 28 2024 19:55:56-08:00 r3 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP 
on the interface Tunnel0/0/0 has entered the UP state. 
[r3-Tunnel0/0/0]nhrp entry 10.1.2.1 15.1.1.1 register	
[r3-Tunnel0/0/0]nhrp network-id 100
[r3-Tunnel0/0/0]q

查看NHRP邻居情况

（5）R1、R4间为点到点的GRE

1）创建隧道接口   2）配置IP地址    3）定义封装方式   4）定义封装内容

[r1]int Tunnel 0/0/0
[r1-Tunnel0/0/0]ip address 10.1.1.1 24

[r1-Tunnel0/0/0]tunnel-protocol gre
[r1-Tunnel0/0/0]source 15.1.1.1
[r1-Tunnel0/0/0]destination 45.1.1.1
Mar 28 2024 20:38:18-08:00 r1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP 
on the interface Tunnel0/0/0 has entered the UP state. 
[r1-Tunnel0/0/0]q

[r4]int Tunnel 0/0/0
[r4-Tunnel0/0/0]ip address 10.1.1.2 24

[r4-Tunnel0/0/0]tunnel-protocol gre
[r4-Tunnel0/0/0]source 45.1.1.1
[r4-Tunnel0/0/0]destination 15.1.1.1
Mar 28 2024 20:38:18-08:00 r1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP 
on the interface Tunnel0/0/0 has entered the UP state. 
[r4-Tunnel0/0/0]q

（6）整个私有网络基于RIP全网可达 

[r1]rip 1
[r1-rip-1]version 2
[r1-rip-1]network 192.168.1.0
[r1-rip-1]network 10.0.0.0
[r1-rip-1]q

[r2]rip 1
[r2-rip-1]version 2
[r2-rip-1]network 192.168.1.0
[r2-rip-1]network 10.0.0.0
[r2-rip-1]q

[r3]rip 1
[r3-rip-1]version 2
[r3-rip-1]network 192.168.3.0
[r3-rip-1]network 10.0.0.0
[r3-rip-1]q

[r4]rip 1
[r4-rip-1]version 2
[r4-rip-1]network 192.168.4.0
[r4-rip-1]network 10.0.0.0
[r4-rip-1]q

使用RIP做MGRE环境，分支只能学到中心的路由，但是没有分支的路由，需要关闭水平分割

[r1]interface Tunnel 0/0/1	
[r1-Tunnel0/0/1]undo rip split-horizon 
[r1-Tunnel0/0/1]q

（7）配置PC

（8）所有PC设置私有Ip为源IP，可以访问R5环回（NAT）

[r1]acl 2000
[r1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[r1-acl-basic-2000]int serial 4/0/0
[r1-Serial4/0/0]nat outbound 2000
[r1-Serial4/0/0]q

[r2]acl 2000
[r2-acl-basic-2000]rule permit source 192.168.2.0 0.0.0.255 
[r2-acl-basic-2000]int serial 4/0/0
[r2-Serial4/0/0]nat outbound 2000
[r2-Serial4/0/0]q

[r3]acl 2000
[r3-acl-basic-2000]rule permit source 192.168.3.0 0.0.0.255
[r3-acl-basic-2000]int serial 4/0/0
[r3-Serial4/0/0]nat outbound 2000
[r3-Serial4/0/0]q

[r4]acl 2000
[r4-acl-basic-2000]rule permit source 192.168.4.0 0.0.0.255
[r4-acl-basic-2000]int g 0/0/0
[r4-GigabitEthernet0/0/0]nat outbound 2000
[r4-GigabitEthernet0/0/0]q

4、验证