每日小实验---MGRE和PPP认证基于静态路由

题目

要求

1. R5为ISP，只能进行IP地址配置，其所有地址均配为公有IP地址
2. R1和R5间使用PPP的PAP认证，R5为主认证方；
   R2于R5之间使用PPP的chap认证，R5为主认证方；
   R3于R5之间使用HDLC封装。
3. R1、R2、R3构建一个MGRE环境，R1为中心站点；R1、R4间为点到点的GRE。
4. 整个私有网络基于静态路由全网可达。
5. 所有PC设置私有IP为源IP，可以访问R5环回。
6. 使用shortcut方式配置DSVPN环境。

配置

分配IP并且配置接口IP地址

R1
[r1]interface Serial 1/0/0
[r1-Serial1/0/0]ip address 15.0.0.1 24
[r1]interface GigabitEthernet 0/0/0
[r1-GigabitEthernet0/0/0]ip address 192.168.1.1 24

R2
[r2]interface Serial 1/0/1
[r2-Serial1/0/0]ip address 25.0.0.1 24
[r2]interface GigabitEthernet 0/0/0
[r2-GigabitEthernet0/0/0]ip address 192.168.2.1 24

R3
[r3]interface Serial 1/0/0
[r3-Serial1/0/0]ip address 35.0.0.1 24
[r3]interface GigabitEthernet 0/0/0
[r3-GigabitEthernet0/0/0]ip address 192.168.3.1 24

R4
[r1]interface GigabitEthernet 0/0/1
[r1-GigabitEthernet0/0/1]ip address 45.0.0.1 24
[r1]interface GigabitEthernet 0/0/0
[r1-GigabitEthernet0/0/0]ip address 192.168.4.1 24

R5
[ISP]interface Serial 1/0/0
[ISP-Serial1/0/0]ip address 15.0.0.2 24
[ISP]interface Serial 1/0/1
[ISP-Serial1/0/1]ip address 25.0.0.1 24
[ISP]interface Serial 2/0/0
[ISP-Serial2/0/0]ip address 45.0.0.1 24
[ISP]interface GigabitEthernet 0/0/0
[ISP-GigabitEthernet0/0/0]ip address 45.0.0.1 24
[ISP]interface LoopBack 0
[ISP-LoopBack0]IP address 5.5.5.1 24

配置认证和HDLC封装

PAP认证
主认证方
[ISP]aaa
[ISP-aaa]local-user xiaozhang password cipher 123456
[ISP-aaa]local-user xiaozhang service-type ppp
[ISP-Serial1/0/0]ppp authentication-mode pap

被认证方
[r1-Serial1/0/0]ppp pap local-user xiaozhang password cipher 123456


CHAP认证
主认证方(先发数据)
[ISP]aaa
[ISP-aaa]local-user dazhang password cipher 123456
[ISP-aaa]local-user dazhang service-type ppp
[ISP-Serial1/0/1]ppp authentication-mode chap

被认证方
[r2-Serial1/0/1]ppp chap user dazhang
[r2-Serial1/0/1]ppp chap password cipher 123456

HDLC封装
[r3-Serial1/0/0]link-protocol hdlc
[ISP-Serial2/0/0]link-protocol hdlc

搭建MGRE和GRE

GRE
R1
[r1]interface Tunnel 0/0/1
[r1-Tunnel0/0/1]ip address 192.168.5.1 24
[r1-Tunnel0/0/1]tunnel-protocol gre
[r1-Tunnel0/0/1]source 15.0.0.1
[r1-Tunnel0/0/1]destination 45.0.0.1
[r1]ip route-static 192.168.4.0 24 192.168.5.4

R4
[r4]interface Tunnel 0/0/1
[r4-Tunnel0/0/1]ip address 192.168.5.4 24
[r4-Tunnel0/0/1]tunnel-protocol gre
[r4-Tunnel0/0/1]source 45.0.0.1
[r4-Tunnel0/0/1]destination 15.0.0.1
[r4]ip route-static 192.168.1.0 24 192.168.5.1

MGRE
Hub节点配置
[r1]interface Tunnel 0/0/0
[r1-Tunnel0/0/0]ip address 192.168.5.1 24
[r1-Tunnel0/0/0]tunnel-protocol gre p2mp
[r1-Tunnel0/0/0]source 15.0.0.1
[r1]ip route-static 192.168.2.0 24 192.168.5.2
[r1]ip route-static 192.168.3.0 24 192.168.5.3

Spoke配置
R2
[r2]interface Tunnel 0/0/0
[r2-Tunnel0/0/0]ip address 192.168.5.2 24
[r2-Tunnel0/0/0]tunnel-protocol gre p2mp 
[r2-Tunnel0/0/0]source Serial 1/0/1
[r2-Tunnel0/0/0]nhrp entry 192.168.5.1 25.0.0.1 register
[r2]ip route-static 192.168.1.0 24 192.168.5.1

R3
[r3]interface Tunnel 0/0/0
[r3-Tunnel0/0/0]ip address 192.168.5.3 24
[r3-Tunnel0/0/0]tunnel-protocol gre p2mp 
[r3-Tunnel0/0/0]source Serial 1/0/0
[r3-Tunnel0/0/0]nhrp entry 192.168.5.1 35.0.0.1 register
[r3]ip route-static 192.168.1.0 24 192.168.5.1

配置NAT

R1
[r1]acl 2000
[r1-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255
[r1]int Serial 1/0/0
[r1-Serial1/0/0]nat outbound 2000

R2
[r2]acl 2000
[r2-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255
[r2]int Serial 1/0/1
[r2-Serial1/0/0]nat outbound 2000

R3
[r3]acl 2000
[r3-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255
[r3]int Serial 1/0/0
[r3-Serial1/0/0]nat outbound 2000

R4
[r4]acl 2000
[r4-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255
[r4]interface GigabitEthernet 0/0/1
[r4-GigabitEthernet0/0/1]nat outbound 2000

测试结果

PC>ping 5.5.5.1

Ping 5.5.5.1: 32 data bytes, Press Ctrl_C to break
From 5.5.5.1: bytes=32 seq=1 ttl=254 time=16 ms
From 5.5.5.1: bytes=32 seq=2 ttl=254 time=31 ms
From 5.5.5.1: bytes=32 seq=3 ttl=254 time=16 ms
From 5.5.5.1: bytes=32 seq=4 ttl=254 time=16 ms
From 5.5.5.1: bytes=32 seq=5 ttl=254 time=31 ms

--- 5.5.5.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 16/22/31 ms

PC>ping 192.168.2.2

Ping 192.168.2.2: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 192.168.2.2: bytes=32 seq=2 ttl=126 time=16 ms
From 192.168.2.2: bytes=32 seq=3 ttl=126 time=31 ms
From 192.168.2.2: bytes=32 seq=4 ttl=126 time=31 ms
From 192.168.2.2: bytes=32 seq=5 ttl=126 time=16 ms

--- 192.168.2.2 ping statistics ---
  5 packet(s) transmitted
  4 packet(s) received
  20.00% packet loss
  round-trip min/avg/max = 0/23/31 ms

PC>ping 192.168.3.2

Ping 192.168.3.2: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 192.168.3.2: bytes=32 seq=2 ttl=126 time=31 ms
From 192.168.3.2: bytes=32 seq=3 ttl=126 time=31 ms
From 192.168.3.2: bytes=32 seq=4 ttl=126 time=32 ms
From 192.168.3.2: bytes=32 seq=5 ttl=126 time=31 ms

--- 192.168.3.2 ping statistics ---
  5 packet(s) transmitted
  4 packet(s) received
  20.00% packet loss
  round-trip min/avg/max = 0/31/32 ms

PC>ping 192.168.4.2

Ping 192.168.4.2: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 192.168.4.2: bytes=32 seq=2 ttl=126 time=32 ms
From 192.168.4.2: bytes=32 seq=3 ttl=126 time=15 ms
From 192.168.4.2: bytes=32 seq=4 ttl=126 time=15 ms
From 192.168.4.2: bytes=32 seq=5 ttl=126 time=32 ms

--- 192.168.4.2 ping statistics ---
  5 packet(s) transmitted
  4 packet(s) received
  20.00% packet loss
  round-trip min/avg/max = 0/23/32 ms