HCIP第一天

目录

1.r5为isp，只能进行ip配置，其所有地址均配为公有IP地址

2.R1与ISP(R5)之间使用PPP的pap认证，ISP(R5)为主认证方，   R2与ISP(R5)之间使用PPP的chap认证，ISP(R5)为主认证方

   R3与R5间使用HDLC认证

3.AR1/4点到点GRE：AR1/2/3构建一个MGRE，AR1为中心站点：

 4.整个私网基于RIP全网可达：

5.所有PC地址为源IP，可以正常访问R5环回做NAT所有的PC都基于环回私有地址为源ip时，可以正常访问AR5环回：

---

MGRE综合实验

1.r5为isp，只能进行ip配置，其所有地址均配为公有IP地址

R1-R4的DHCP和网关配置，写完代码，打开PC基础配置将静态改为DHCP
[r1]dhcp enable

[r1]ip pool 1
[r1-ip-pool-1]network 192.168.1.0 mask 24
[r1-ip-pool-1]gateway-list 192.168.1.254
[r1-ip-pool-1]dns-list 8.8.8.8
[r1-ip-pool-1]int g0/0/0
[r1-GigabitEthernet0/0/0]ip address 192.168.1.254 24
[r1-GigabitEthernet0/0/0]dhcp select global

[r2]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[r2]ip pool 2
Info: It’s successful to create an IP address pool.
[r2-ip-pool-2]network 192.168.2.0 mask 24
[r2-ip-pool-2]dns-list 8.8.8.8
[r2-ip-pool-2]gateway-list 192.168.2.254
[r2-ip-pool-2]int g0/0/0
[r2-GigabitEthernet0/0/0]ip address 192.168.2.254 24
[r2-GigabitEthernet0/0/0]dhcp select global

[r3]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[r3]ip pool 3
Info: It’s successful to create an IP address pool.
[r3-ip-pool-3]network 192.168.3.0 mask 24
[r3-ip-pool-3]dns-list 8.8.8.8
[r3-ip-pool-3]gateway-list 192.168.3.254
[r3-ip-pool-3]int g 0/0/0
[r3-GigabitEthernet0/0/0]ip address 192.168.3.254 24
[r3-GigabitEthernet0/0/0]dhcp select global

[r4]dhcp enable
[r4]ip pool 4
[r4-ip-pool-4]network 192.168.4.0 mask 24
[r4-ip-pool-4]gateway-list 192.168.4.254
[r4-ip-pool-4]dns-list 114.114.114.114 8.8.8.8
[r4-ip-pool-4]int g0/0/0
[r4-GigabitEthernet0/0/0]ip address 192.168.4.254 24
[r4-GigabitEthernet0/0/0]dhcp select global

2.R1与ISP(R5)之间使用PPP的pap认证，ISP(R5)为主认证方，
   R2与ISP(R5)之间使用PPP的chap认证，ISP(R5)为主认证方

   R3与R5间使用HDLC认证

pap若需要双向认证，密码需要一致

[r1]int serial 4/0/0
ip add 15.1.1.1 24

[r5]aaa
local-user lxl passwd cipher 123456
local-user lxl service-type ppp
[r5]int serial 3/0/0
ppp authentication-mode pap
ip add 15.1.1.2 24
shutdown
undo shutdown

[r1]ppp pap passwd cipher 123456

[r2]int serial 4/0/0
ip add 25.1.1.1 24

[r5]aaa
local-user lxl passwd cipher 123456
local-user lxl service-type ppp
[r5]int serial 3/0/1
ppp authentication-mode chap
ip add 25.1.1.2 24
shutdown
undo shutdown

[r2]ppp chap passwd cipher 123456

将其他串线接口配置完整，写R1-R4到R5的缺省

[r3]ip route-static 0.0.0.0 0 35.1.1.2
[r2]ip route-static 0.0.0.0 0 25.1.1.2
[r1]ip route-static 0.0.0.0 0 15.1.1.2

R3与R5间使用HDLC认证：
[r2]int serial 4/0/0
ip add 35.1.1.1 24
link-protocol hdlc

[r5]aaa
local-user lxl passwd cipher 123456
local-user lxl service-type ppp
[r5]int serial 4/0/0
link-protocol hdlc
ppp authentication-mode chap
ip add 35.1.1.2 24

[r1]ip route-static 0.0.0.0 0 15.1.1.2
[r2]ip route-static 0.0.0.0 0 25.1.1.2
[r3]ip route-static 0.0.0.0 0 35.1.1.2
[r4]ip route-static 0.0.0.0 0 45.1.1.2

 

3.AR1/4点到点GRE：AR1/2/3构建一个MGRE，AR1为中心站点：

[r1]int tunnel 0/0/0
ip add 10.1.1.1 24
tunnel-protocol gre
source 15.1.1.1
destination 45.1.1.1

[r4]int tunnel 0/0/0
ip add 10.1.1.2 24
tunnel-protocol gre
source 45.1.1.1
destination 15.1.1.1

[r1]int tunnel 0/0/1 创建tunnel口
ip add 10.1.2.1 24 配置接口IP地址
tunnel-protocol gre p2mp 修改接口模式为多点GRE
source 15.1.1.1 定义公有源IP地址
nhrp entry multicast dynamic 本地成为NHRP 中心，可以进行伪广播
nhrp network-id 100 该网段内所有节点tunnel接口必须为相同域

[r2]int tunnel 0/0/0
ip add 10.1.2.2 24
tunnel-protocol gre p2mp
source serial 4/0/0
nhrp entry 10.1.2.1 15.1.1.1 register
nhrp network-id 100

[r3]int tunnel 0/0/0
ip add 10.1.2.3 24
tunnel-protocol gre p2mp
source serial 4/0/0
nhrp entry 10.1.2.1 15.1.1.1 register
nhrp network-id 100

 

 4.整个私网基于RIP全网可达：

[r1]rip 1
[r1-rip-100]version 2
[r1-rip-100]undo summary
[r1-rip-100]network 192.168.1.0
[r1-rip-100]network 10.0.0.0

 

[r3]rip 100
[r3-rip-100]version 2
[r3-rip-100]undo summary
[r3-rip-100]network 192.168.3.0
[r3-rip-100]network 10.0.0.0

[r4]rip 100
[r4-rip-100]version 2
[r4-rip-100]undo summary
[r4-rip-100]network 192.168.4.0
[r4-rip-100]network 10.0.0.0

需要关闭RIP的水平分割使R2R3可以到达R1
全网正常收敛；
[r1-Tunnel0/0/0]undo rip split-horizon
[r2-Tunnel0/0/0]undo rip split-horizon
[r3-Tunnel0/0/0]undo rip split-horizon

.写缺省
[r4-Tunnel0/0/1]ip route-static 0.0.0.0 0 45.1.1.2

 

5.所有PC地址为源IP，可以正常访问R5环回
做NAT
所有的PC都基于环回私有地址为源ip时，可以正常访问AR5环回：

[r1]acl 2000
[r1-acl-basic-2000]rule 0 permit source 192.168.1.0 0.0.0.255
[r1-acl-basic-2000]int S4/0/0
[r1-Serial4/0/0]nat outbound 2000

 测试结果：