实验拓扑
实验需求
1、R5为ISP,只能进行IP地址配置,其所有地址均配为公有IP地址;
2、R1和R5间使用PPP的PAP认证,R5为主认证方;
R2与R5之间使用ppp的CHAP认证,R5为主认证方;
R3与R5之间使用HDLC封装;
3.R1、R2、R3构建一个MGRE环境,R1为中心站点,R1、R4间为点到点的GRE;
4.整个私有网络基本RIP全网可达
5.所有Pc设置私有IP为源IP,可以访问R5环回,达到全网通。
实验思路
1.配ip
2.ppp认证
3.公网通
4.构建隧道
5.配rip,传私网路由
6.做easyIP,实现全网通
实验步骤
1.配ip
[R1]interface G0/0/0
[R1-GigabitEthernet0/0/0]IP ADD
[R1-GigabitEthernet0/0/0]IP address 192.168.1.254 24
Jul 25 2024 11:09:29-08:00 R1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[R1-GigabitEthernet0/0/0]int s4/0/0
[R1-Serial4/0/0]ip add 15.1.1.1 24
[R1-Serial4/0/0]q
[R1]dis ip int b
[R2]int g0/0/0
[R2-GigabitEthernet0/0/0]ip add 192.168.2.254 24
Jul 25 2024 11:12:32-08:00 R2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[R2-GigabitEthernet0/0/0]int s4/0/0
[R2-Serial4/0/0]ip add 25.1.1.2 24
[R2-Serial4/0/0]q
[R2]dis ip int b
[R3]int g0/0/0
[R3-GigabitEthernet0/0/0]ip add 192.168.3.254 24
Jul 25 2024 11:14:14-08:00 R3 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[R3-GigabitEthernet0/0/0]int s 4/0/0
[R3-Serial4/0/0]ip add 35.1.1.3 24
[R3-Serial4/0/0]q
[R3]dis ip int b
[R4]int g0/0/0
[R4-GigabitEthernet0/0/0]ip add 45.1.1.4 24
[R4-GigabitEthernet0/0/0]
Jul 25 2024 11:17:00-08:00 R4 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[R4-GigabitEthernet0/0/0]int g0/0/1
[R4-GigabitEthernet0/0/1]ip add 192.168.4.254 24
Jul 25 2024 11:17:43-08:00 R4 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP
on the interface GigabitEthernet0/0/1 has entered the UP state.
[R4-GigabitEthernet0/0/1]q
[R4]dis ip int b
[R5]int s4/0/1
[R5-Serial4/0/1]ip add 15.1.1.5 24
[R5-Serial4/0/1]
Jul 25 2024 11:19:25-08:00 R5 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol PPP
IPCP on the interface Serial4/0/1 has entered the UP state.
[R5-Serial4/0/1]int s3/0/1
[R5-Serial3/0/1]ip add 25.1.1.5 24
[R5-Serial3/0/1]
Jul 25 2024 11:20:03-08:00 R5 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol PPP
IPCP on the interface Serial3/0/1 has entered the UP state.
[R5-Serial3/0/1]int s4/0/0
[R5-Serial4/0/0]ip add 35.1.1.5 24
[R5-Serial4/0/0]
Jul 25 2024 11:21:18-08:00 R5 %%01IFNET/4/LINK_STATE(l)[2]:The line protocol PPP
IPCP on the interface Serial4/0/0 has entered the UP state.
[R5-Serial4/0/0]int g0/0/0
[R5-GigabitEthernet0/0/0]ip add 45.1.1.5 24
Jul 25 2024 11:22:00-08:00 R5 %%01IFNET/4/LINK_STATE(l)[3]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[R5-GigabitEthernet0/0/0]q
[R5]int l0
[R5-LoopBack0]ip add 5.5.5.5 24
[R5-LoopBack0]q
[R5]dis ip int b
2.ppp认证
R5主认证方
[R5]
[R5]aaa
[R5-aaa]l
[R5-aaa]local-user wang p
[R5-aaa]local-user wang password c
[R5-aaa]local-user wang password cipher w123
Info: Add a new user.
[R5-aaa]l
[R5-aaa]local-user wang se
[R5-aaa]local-user wang service-type ppp
[R5-aaa]q
[R5]int s4/0/1
[R5-Serial4/0/1]ppp a
[R5-Serial4/0/1]ppp authentication-mode pap
[R5-Serial4/0/1]q
R1 被认证方
[R1]int s4/0/0
[R1-Serial4/0/0]ppp pap l
[R1-Serial4/0/0]ppp pap local-user wang p
[R1-Serial4/0/0]ppp pap local-user wang password c
[R1-Serial4/0/0]ppp pap local-user wang password cipher w123
测试
[R5-aaa]q
[R5]int s3/0/1
[R5-Serial3/0/1]ppp a
[R5-Serial3/0/1]ppp authentication-mode chap
[R5-Serial3/0/1]q
[R5]
[R2-Serial4/0/0]ppp ch
[R2-Serial4/0/0]ppp chap uer
[R2-Serial4/0/0]ppp chap u
[R2-Serial4/0/0]ppp chap user wang
[R2-Serial4/0/0]ppp chap pa
[R2-Serial4/0/0]ppp chap password c
[R2-Serial4/0/0]ppp chap password cipher w123
测试
R3与R5之间使用HDLC封装
[R5]int s4/0/0
[R5-Serial4/0/0]li
[R5-Serial4/0/0]link-protocol h
[R5-Serial4/0/0]link-protocol hdlc
Warning: The encapsulation protocol of the link will be changed. Continue? [Y/N]
:y
[R3-Serial4/0/0]li
[R3-Serial4/0/0]link-protocol h
[R3-Serial4/0/0]link-protocol hdlc
Warning: The encapsulation protocol of the link will be changed. Continue? [Y/N]
:y
检查
3.公网通
[R1]ip route-static 0.0.0.0 0 15.1.1.5
[R1]
[R2]ip route-static 0.0.0.0 0 25.1.1.5
[R2]
[R3]ip route-static 0.0.0.0 0 35.1.1.5
[R3]
[R4]ip route-static 0.0.0.0 0 45.1.1.5
检查
4.构建隧道
1)MGRE
[R1]interface Tunnel 0/0/0 --- 创建GRE随道接口
[R1-Tunnel0/0/0]ip add 10.1.1.1 24 ---- 配置隧道IP地址
[R1-Tunnel0/0/0]tunnel-protocol gre p2mp ---- 定义封装方式
[R1-Tunnel0/0/0]source 15.1.1.1---- 定义隧道被封装的源地址
NHRP的配置
中心站点配置:
[R1-Tunnel0/0/0]nhrp network-id 100(100自定义数字) // 创建NHRP域
[R2]int Tunnel 0/0/0 -- 创建GRE随道接口
[R2-Tunnel0/0/0]ip address 10.1.1.2 24--- 配置隧道IP地址
[R2-Tunnel0/0/0]tunnel-protocol gre p2mp ---- 定义封装方式
[R2-Tunnel0/0/0]source Serial 4/0/0---- 定义隧道被封装的源地址
分支站点配置:
[R2-Tunnel0/0/0]nhrp network-id 100 //分支加入中心站点域100
[R2-Tunnel0/0/0]nhrp entry 10.1.1.1 15.1.1.1 register // 分支找中心注册自己的信息
[R2-Tunnel0/0/0]
[R3]int Tunnel 0/0/0 -- 创建GRE随道接口
[R3-Tunnel0/0/0]tunnel-protocol gre p2mp ---- 定义封装方式
[R3-Tunnel0/0/0]ip add 10.1.1.3 24 --- 配置隧道IP地址
[R3-Tunnel0/0/0]source Serial 4/0/0 ---- 定义隧道被封装的源地址
[R3-Tunnel0/0/0]nhrp network-id 100 //分支加入中心站点域100
[R3-Tunnel0/0/0]nhrp entry 10.1.1.1 15.1.1.1 register // 分支找中心注册自己的信息
[R3-Tunnel0/0/0]
2)GRE
[R1]INT Tunnel 0/0/1 --- 创建GRE随道接口
[R1-Tunnel0/0/1]ip add 10.1.2.1 24 ---- 配置隧道IP地址
[R1-Tunnel0/0/1]tunnel-protocol gre ---- 定义封装方式
[R1-Tunnel0/0/1]source 15.1.1.1 ---- 定义隧道被封装的源地址
[R1-Tunnel0/0/1]destination 45.1.1.4 ---- 定义隧道被封装的目标地址
[R1-Tunnel0/0/1]
[R4]int Tunnel 0/0/1 --- 创建GRE随道接口
[R4-Tunnel0/0/1]ip add 10.1.2.4 24 --- 配置隧道IP地址
[R4-Tunnel0/0/1]tunnel-protocol gre ---- 定义封装方式
[R4-Tunnel0/0/1]source 45.1.1.4 ---- 定义隧道被封装的源地址
[R4-Tunnel0/0/1]destination 15.1.1.1 ---- 定义隧道被封装的目标地址
[R4-Tunnel0/0/1]q
[R4]
5.配rip,传私网路由
[R1]rip 1
[R1-rip-1]v 2(RIPv1不能关闭自动汇总,RIPv2可以在关闭自动汇总的前提下,进行手工汇总)
[R1-rip-1]un
[R1-rip-1]undo su
[R1-rip-1]undo summary
[R1-rip-1]net 192.168.1.0
[R1-rip-1]net 10.0.0.0(rip按主类宣告,不能是10.1.1.0)
[R1-rip-1]
[R2]
[R2]rip 1 //选择RIP的协议进程号
[R2-rip-1]v 2 //选择RIP协议的版本号
[R2-rip-1]un
[R2-rip-1]undo su
[R2-rip-1]undo summary //关闭自动汇总功能
[R2-rip-1]net 192.168.2.0 主类宣告自己的直连网段
[R2-rip-1]net 10.0.0.0
[R2-rip-1] //RIP的 协议视图
[R3]rip 1
[R3-rip-1]v 2
[R3-rip-1]un
[R3-rip-1]undo su
[R3-rip-1]undo summary
[R3-rip-1]net 192.168.3.0
[R3-rip-1]net 10.0.0.0
[R3-rip-1]
[R4]rip 1
[R4-rip-1]v 2
[R4-rip-1]un
[R4-rip-1]undo su
[R4-rip-1]undo summary
[R4-rip-1]net 192.168.4.0
[R4-rip-1]net 10.0.0.0
[R4-rip-1]q
[R4]
在MGRE环境下使用RIP来获取未知网段的路由信息
1、只有中心获取到分支的路由信息,但是分支并没有获取到中心的路由信息;
解决方法:在中心上开启伪广播
[R1-Tunnel0/0/0]nhrp entry multicast dynamic
2、分支在中心开启伪广播后,分支只能获取到中心的路由信息,但是无法获取分支之间的路由信息;
解决方案:关闭接口的水平分割
[R2-Tunnel0/0/0]undo rip split-horizon
[R1]int Tunnel 0/0/0
[R1-Tunnel0/0/0]nhrp entry multicast dynamic //在中心上开启伪广播
[R1-Tunnel0/0/0]undo rip split-horizon //关闭接口的水平分割
[R1-Tunnel0/0/0]
[R2]int t
[R2]int Tunnel 0/0/0
[R2-Tunnel0/0/0]undo rip split-horizon
[R2-Tunnel0/0/0]
[R3]int t
[R3]int Tunnel 0/0/0
[R3-Tunnel0/0/0]undo rip split-horizon
[R3-Tunnel0/0/0]q
[R3]
6.做easyIP,实现全网通
[R1]acl 2000
[R1-acl-basic-2000]r
[R1-acl-basic-2000]reset
[R1-acl-basic-2000]ru
[R1-acl-basic-2000]rule p
[R1-acl-basic-2000]rule permit s
[R1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[R1-acl-basic-2000]q
[R1]int s4/0/0
[R1-Serial4/0/0]o
[R1-Serial4/0/0]oam
[R1-Serial4/0/0]ou
[R1-Serial4/0/0]na
[R1-Serial4/0/0]nat ou
[R1-Serial4/0/0]nat outbound 2000
[R1-Serial4/0/0]q
[R1]
[R2]acl 2000
[R2-acl-basic-2000]rl
[R2-acl-basic-2000]ru
[R2-acl-basic-2000]rule p
[R2-acl-basic-2000]rule permit s
[R2-acl-basic-2000]rule permit source 192.168.2.0 0.0.0.255
[R2-acl-basic-2000]q
[R2]int s4/0/0
[R2-Serial4/0/0]nat o
[R2-Serial4/0/0]nat outbound 2000
[R2-Serial4/0/0]
[R2-Serial4/0/0]
[R2-Serial4/0/0]q
[R2]
[R3]acl 2000
[R3-acl-basic-2000]ru
[R3-acl-basic-2000]rule p
[R3-acl-basic-2000]rule permit s
[R3-acl-basic-2000]rule permit source 192.168.3.0 0.0.0.255
[R3-acl-basic-2000]q
[R3]int s4/0/0
[R3-Serial4/0/0]n
[R3-Serial4/0/0]nat o
[R3-Serial4/0/0]nat outbound 2000
[R3-Serial4/0/0]
[R4]acl 2000
[R4-acl-basic-2000]r
[R4-acl-basic-2000]ru
[R4-acl-basic-2000]rule p
[R4-acl-basic-2000]rule permit s
[R4-acl-basic-2000]rule permit source 192.168.4.0 0.0.0.255
[R4-acl-basic-2000]q
[R4]int g0/0/0
[R4-GigabitEthernet0/0/0]na
[R4-GigabitEthernet0/0/0]nat o
[R4-GigabitEthernet0/0/0]nat outbound 2000
[R4-GigabitEthernet0/0/0]q
[R4]
测试