H3C PPP认证基本配置实验

H3C PPP认证基本配置实验

实验拓扑

​​​​

实验需求

1. R1 和 R2 使用 PPP 链路直连，R2 和 R3 把 2 条 PPP 链路捆绑为 PPP MP 直连
2. 按照图示配置 IP 地址
3. R2 对 R1 的 PPP 进行单向 chap 验证
4. R2 和 R3 的 PPP 进行双向 chap 验证

实验步骤

R2 和 R3 把 2 条 PPP 链路捆绑为 PPP MP 直连

R2配置

#
interface MP-group1
#
interface Serial1/0
 ppp mp MP-group1 
#
interface Serial2/0
 ppp mp MP-group1 

R3配置

#
interface MP-group1
#
interface Serial1/0
 ppp mp MP-group1 
#
interface Serial2/0
 ppp mp MP-group1 

配置设备IP地址

R1配置

#
interface Serial1/0
 ip address 192.168.1.1 255.255.255.0

R2配置

#
interface Serial3/0
 ip address 192.168.1.2 255.255.255.0
#
interface MP-group1
 ip address 192.168.2.2 255.255.255.0

R3配置

#
interface MP-group1
 ip address 192.168.2.3 255.255.255.0

配置单向chap验证

R2 对 R1 的 PPP 进行单向 chap 验证，说明R2是主验证方，R1是被验证方；

R2配置

所以在R2上创建用于认证R1的用户

#
local-user user1 class network
 password simple 123
 service-type ppp
#
interface Serial3/0
 ppp authentication-mode chap 

R1配置

被验证方在接口处，配置正确的账号密码

#
interface Serial1/0
 ppp chap password simple 123
 ppp chap user user1

配置双向chap验证

R2 和 R3 的 PPP 进行双向 chap 验证

双向验证意味着 R2 和 R3 双方都需要创建用于验证的用户，且需要在各自接口上配置对端的用户名

另外，虽然R2 和 R3 之间的 PPP 链路配置了 PPP-MP，但是身份验证仍然需要配置在物理接口上，所以 R2 和 R3 相连的所有 PPP 接口上都需要配置验证

当使用双向认证时，双方配置相似，可以各自使用不同的账户密码。但是，若使用的密码相同，则在接口向对方配置认证时，可以不用配置 ppp chap password 用户密码，但是必须配置 ppp chap user 用户名！！！

因为在哈希时，是将ID、随机数、密码做哈希，本地接口没有配置 ppp chap password 用户密码，则查本地数据库，将那个密码做哈希，则认证方核对哈希时是一致的，则认证通过。

猜测：如若本地有多个ppp账户密码，则此次不可如此！缘由是它不知道用哪个密码去认证！此次须在接口指定配置对方的密码~（仅仅猜测）

R2配置

#
interface Serial1/0
 ppp authentication-mode chap 
 ppp chap user user3     //密码一致，可以只配用户名
#
interface Serial2/0
 ppp authentication-mode chap 
 ppp chap user user3     //密码一致，可以只配用户名 
#
local-user user2 class network
 password simple 123
 service-type ppp

R3配置

#
interface Serial1/0
 ppp authentication-mode chap 
 ppp chap user user2     //密码一致，可以只配用户名 
#
interface Serial2/0
 ppp authentication-mode chap 
 ppp chap user user2     //密码一致，可以只配用户名 
#
local-user user3 class network
 password simple 123
 service-type ppp

配置后验证效果

当设备接口未PPP认证成功，或未进行认证，端口协议会一直处于UP DOWN 的状态

[R1]%Feb  4 11:27:35:877 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to up.
%Feb  4 11:27:35:878 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to down.
%Feb  4 11:28:07:419 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to up.
%Feb  4 11:28:07:419 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to down.
%Feb  4 11:28:39:085 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to up.
%Feb  4 11:28:39:085 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to down.
%Feb  4 11:29:10:808 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to up.
%Feb  4 11:29:10:809 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to down.
%Feb  4 11:29:42:614 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to up.
%Feb  4 11:29:42:615 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to down.
%Feb  4 11:30:14:403 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to up.
%Feb  4 11:30:14:403 2024 R1 IFNET/5/LINK_UPDOWN: Line protocol state on the interface Serial1/0 changed to down.

当R1连接R2的接口配置了PPP认证，且账号密码正确，端口的物理状态和协议状态都是UP的

[R1]display interface brief 
Brief information on interfaces in route mode:
Link: ADM - administratively down; Stby - standby
Protocol: (s) - spoofing
Interface            Link Protocol Primary IP      Description                      
Ser1/0               UP   UP       192.168.1.1    

R2 和 R3 的 PPP 进行双向 chap 验证

[R2]display interface brief 
Brief information on interfaces in route mode:
Link: ADM - administratively down; Stby - standby
Protocol: (s) - spoofing
Interface            Link Protocol Primary IP      Description                   
MP1                  UP   UP       192.168.2.2         
Ser1/0               UP   UP       --          
Ser2/0               UP   UP       --                

[R3]display interface brief 
Brief information on interfaces in route mode:
Link: ADM - administratively down; Stby - standby
Protocol: (s) - spoofing
Interface            Link Protocol Primary IP      Description                     
MP1                  UP   UP       192.168.2.3             
Ser1/0               UP   UP       --          
Ser2/0               UP   UP       --            

实验附件

H3C PPP认证基本配置实验.zip

‍