一、实验需求
1、按照图示配置ip地址:
公网地址为11.1.1.0/24、22.1.1.0/24、33.1.1.0/24
私网地址为192.168.1.0/24、192.168.2.0/24、192.168.3.0/24
Tunnel虚拟地址为192.168.4.0/24
R2环回ip为6.6.6.6/24
2、R2为ISP,其上只能配置IP地址
3、R1-R2之间为HDLC封装
4、R2-R3之间为ppp封装,pap认证,R2为主认证方
5、R2-R4之间为PPP封装,chap认证,R2为主认证方
6、R1、R2、R3构建MGRE环境,仅R1地址固定
7、内网使用RIP获取路由,所有pc可以五相访问,并且可访问R2的环回。
二、实验思路
1、配置IP地址部分
2、R1、R3、R4作为连接公私网的网络出口设备,在其上配置缺省路由指向公网,实现公网互通。
3、R1和R3上面采用HDLC封装,R2-R3之间为ppp封装,pap认证,R2为主认证方,R2-R4之间为PPP封装,chap认证,R2为主认证方
4、配置MGRE使R1为服务端,R3和R4为客户端,R3和R4需要从R1上获取到MAP。
5、在R1、R3、R4上配置rip协议,宣告连接PC网段和Tunnel网段,再将连接pc的口设为沉默接口。因为rip上存在水平分割防环机制,会使路由器中路由不齐,所以需要在Tunnel口中将水平分割功能关闭。
6、私网上配置NAT SERVER采用一对多的方式将将多个私有ip地址转换为同一个公有ip地址,使所有pc可以访问R2的环回地址。
三、实验步骤
1、配置ip地址
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip add 192.168.1.1 24
[R1-GigabitEthernet0/0/0]int s4/0/0
[R1-Serial4/0/0]ip address 11.1.1.1 24
[R2]int s4/0/0
[R2-Serial4/0/0]ip address 11.1.1.2 24
[R2-Serial4/0/0]int s4/0/1
[R2-Serial4/0/1]ip address 22.1.1.1 24
[R2-Serial4/0/1]int s3/0/0
[R2-Serial3/0/0]ip address 33.1.1.1 24
[R2]int lo1
[R2-LoopBack1]ip address 6.6.6.6 255.255.255.0
[R3]int s4/0/0
[R3-Serial4/0/0]ip address 22.1.1.2 24
[R3-Serial4/0/0]int g0/0/0
[R3-GigabitEthernet0/0/0]ip address 192.168.2.1 24
[R4]int s4/0/0
[R4-Serial4/0/0]ip address 33.1.1.2 24
[R4-Serial4/0/0]int g0/0/0
[R4-GigabitEthernet0/0/0]ip address 192.168.3.1 24
2、配置公网互通,并测试是否访问公网
[R1]ip route-static 0.0.0.0 0.0.0.0 11.1.1.2
[R3]ip route-static 0.0.0.0 0.0.0.0 22.1.1.1
[R4]ip route-static 0.0.0.0 0.0.0.0 33.1.1.1
3、封装:
R1和R2上面采用HDLC封装,R2-R3之间为ppp封装,pap认证,R2为主认证方,R2-R4之间为PPP封装,chap认证,R2为主认证方
HDLC封装
[R1]int s4/0/0
[R1-Serial4/0/0]link-protocol hdlc
[R1-Serial4/0/0]shutdown
[R1-Serial4/0/0]undo shutdown
[R2]int s4/0/0
[R2-Serial4/0/0]link-protocol hdlc
[R2-Serial4/0/0]shutdown
[R2-Serial4/0/0]undo shutdown
pap明文认证,主认证方R2
[R2]aaa
[R2-aaa]local-user qian password cipher 0420
[R2-aaa]local-user qian service-type ppp
[R2]int s4/0/1
[R2-Serial4/0/1]ppp authentication-mode pap
[R2-Serial4/0/1]shutdown
[R2-Serial4/0/1]undo shutdown
被认证方R3
[R3]int s4/0/0
[R3-Serial4/0/0]ppp pap local-user qian password cipher 0420
[R3-Serial4/0/0]shutdown
[R3-Serial4/0/0]undo shutdown
chap密文认证,主认证方R2
[R2]aaa
[R2-aaa]local-user li password cipher 2000
[R2-aaa]local-user li service-type ppp
[R2]int s3/0/0
[R2-Serial3/0/0]ppp authentication-mode chap
[R2-Serial3/0/0]shutdown
[R2-Serial3/0/0]undo shutdown
被认证方R4
[R4]int s4/0/0
[R4-Serial4/0/0]ppp chap user li
[R4-Serial4/0/0]ppp chap password cipher 2000
[R4-Serial4/0/0]shutdown
[R4-Serial4/0/0]undo shutdown
4、查看接口封装
[R1]interface Tunnel 0/0/0
[R1-Tunnel0/0/0]ip address 192.168.4.1 24
[R1-Tunnel0/0/0]tunnel-protocol gre p2mp
[R1-Tunnel0/0/0]source 11.1.1.1
通过NHRP协议来获取加封装的目标ip地址
[R1-Tunnel0/0/0]nhrp entry multicast dynamic
[R1-Tunnel0/0/0]nhrp network-id 100
分支站点R3:
[R3]interface Tunnel 0/0/0
[R3-Tunnel0/0/0]ip address 192.168.4.2 24
[R3-Tunnel0/0/0]tunnel-protocol gre p2mp
加封装的目标ip地址,需要到NHRP中心站点获取
[R3-Tunnel0/0/0]nhrp entry 192.168.4.1 11.1.1.1 register
[R3-Tunnel0/0/0]nhrp network-id 100
分支站点R4:
[R4]interface Tunnel 0/0/0
[R4-Tunnel0/0/0]ip address 192.168.4.3 24
[R4-Tunnel0/0/0]tunnel-protocol gre p2mp
加封装的目标ip地址,需要到NHRP中心站点获取
[R4-Tunnel0/0/0]nhrp entry 192.168.4.1 11.1.1.1 register
[R4-Tunnel0/0/0]nhrp network-id 100
5、配置rip协议
[R1]rip
[R1-rip-1]v 2
[R1-rip-1] network 192.168.1.0
[R1-rip-1] network 192.168.4.0
[R1-rip-1]silent-interface GigabitEthernet 0/0/0
[R1-Tunnel0/0/0]undo rip split-horizon
[R3]rip
[R3-rip-1]v 2
[R3-rip-1] network 192.168.2.0
[R3-rip-1] network 192.168.4.0
[R3-rip-1]silent-interface GigabitEthernet 0/0/0
[R3-Tunnel0/0/0]undo rip split-horizon
[R4]rip
[R4-rip-1]v 2
[R4-rip-1] network 192.168.3.0
[R4-rip-1] network 192.168.4.0
[R4-rip-1]silent-interface GigabitEthernet 0/0/0
[R4-Tunnel0/0/0]undo rip split-horizon
6、 私网上配置NAT SERVER采用一对多的方式将将多个私有ip地址转换为同一个公有ip地址
[R1]acl 2000
[R1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[R1]int s4/0/0
[R1-Serial4/0/0]nat outbound 2000
[R3]acl 2000
[R3-acl-basic-2000]rule permit source 192.168.2.0 0.0.0.255
[R3]int s4/0/0
[R3-Serial4/0/0]nat outbound 2000
[R4]acl 2000
[R4-acl-basic-2000]rule permit source 192.168.3.0 0.0.0.255
[R4]int s4/0/0
[R4-Serial4/0/0]nat outbound 2000
测试