华为路由器：PPPOE配置模拟实验及NAT配置

admin

实验环境

pppoe-client上面的接口信息
5 D, O# h; F& W; K0 H9 |( V
[AR1]dis ip interface brief
% g9 V6 D7 c$ d# `4 u" ?( h& p- `+ ]*down: administratively down
+ g8 a% t6 ?; }^down: standby
(l): loopback
(s): spoofing
The number of interface that is UP in Physical is 2
The number of interface that is DOWN in Physical is 1
The number of interface that is UP in Protocol is 1
The number of interface that is DOWN in Protocol is 2

5 |& t9 d- ]6 F' G0 ?4 d: DInterface                         IP Address/Mask      Physical   Protocol  
: Z6 D9 G3 z* ?+ o, F& ^- _GigabitEthernet0/0/0              unassigned           up         down      
GigabitEthernet0/0/1              192.168.1.254/24     down       down      
9 L1 x9 D" ~, h+ MNULL0                             unassigned           up         up(s)     
+ [; S3 X# X# @3 w
, o: M9 }: q3 u# `  z
) J; M3 V. h- u5 ~8 J配置了基于接口的DHCP

interface GigabitEthernet0/0/1
( x$ h) i7 P5 @& a& s) Q ip address 192.168.1.254 255.255.255.0
5 ?0 f9 S  U- G$ g, U dhcp select interface
dhcp server dns-list 8.8.8.8
dhcp server domain-name pokes.com

注意事项：AR1、AR2的物理接口g0/0/0不配地址.
0 l4 a2 a+ ?' f) c3 `3 D, n
一、pppoe-server的配置
# u8 |0 a& c- n4 D2 x1、pppoe-server 配置地址池
[pppoe-server]ip pool pokes            #创建名为pokes的地址池，名字可以随便起，后面要调用
- c" g/ |5 M, |- c/ t0 P6 QInfo: It's successful to create an IP address pool.
6 ?. ?% k7 m& [* Q* {1 F[pppoe-server-ip-pool-pokes]network 10.1.12.0 mask 24   #地址池为10.1.12.0/24
[pppoe-server-ip-pool-pokes]dis th
' s$ i; o9 r3 P: |) W! x% X[V200R003C00]
1 N  D9 t: q6 j% O7 M" ?#
ip pool pokes
network 10.1.12.0 mask 255.255.255.0
# m& D8 Q$ d% G; \#
return
* N% h2 E6 A. K0 L# G8 `2 [* i[pppoe-server-ip-pool-pokes]q
; ]# |# B/ |5 ?; y6 q; l7 k
, g; H' q& N0 `9 x+ @3 h2、配置虚拟口关联地址池
% f( K6 h& m" Y2 ^  r配置虚拟口关联地址池，即创建Virtual-Template 1模版。
: ?4 Q- \# T2 m2 T! i
) Z% t& i. j; y, K: m[pppoe-server]interface Virtual-Template 1    #创建虚拟接口1
: S% s4 U% n, t[pppoe-server-Virtual-Template1]ip add 10.1.12.2 24                   #虚拟接口1的地址
[pppoe-server-Virtual-Template1]ppp authentication-mode chap   #认证类型
6 M8 h' l  J/ ]( ]4 ^  U, P3 N- @. i[pppoe-server-Virtual-Template1]remote address pool pokes      #客户端的地址池pokes
! Q- E! r( r% n% ?& g4 [4 X[pppoe-server-Virtual-Template1]dis th
interface Virtual-Template1
- y  S+ u+ O* c5 j0 U* k ppp authentication-mode chap
remote address pool pokes
0 l) v* _1 p# E, v ip address 10.1.12.2 255.255.255.0
9 s% x# _" s4 C" m  e
. ]1 p; \* q! v$ j5 N[pppoe-server]int g0/0/0       
1 X. o5 g: R* Z; {6 Q( c[pppoe-server-GigabitEthernet0/0/0]pppoe-server bind virtual-template 1   #将虚拟接口1关联到g0/0/0接口
[pppoe-server-GigabitEthernet0/0/0]dis th
[V200R003C00]
/ u, |1 [7 `# [, {#
9 Y  ^0 ^" x" \$ qinterface GigabitEthernet0/0/0
, J/ ?- y$ W/ v2 o' \6 } pppoe-server bind Virtual-Template 1
#
- c9 z+ G2 C0 Z) p5 Wreturn
5 I% W$ ~' [7 L# w! x! U[pppoe-server-GigabitEthernet0/0/0]
  z/ o. L0 P" g2 M! M. B
3、创建pppoe拨号的账号
按理我们应该创建pppoe拨号的账号。
这里为了演示拨号失败，我们这里先不新建账号，后面再新建。
% S+ Y$ B1 t+ Z1 B+ g' G& W
二、pppoe-client的配置
[pppoe-client]dialer-rule   
[pppoe-client-dialer-rule]dialer-rule 1 ?
+ f& Z: ]! a2 S; r  acl   Permit or deny based on access-list   
  ip    Ip
  ipv6  Ipv6       
8 w6 ?1 f. v# V0 P" q# |9 ]! f- _[pppoe-client-dialer-rule]dialer-rule 1 ip permit   #创建拨号规则，允许ip流量触发拨号
9 Y7 s" X8 |5 R6 R: w) r
[pppoe-client]interface Dialer 1
Jul 15 2021 18:55:22-08:00 pppoe-client %%01IFPDT/4/IF_STATE(l)[0]:Interface Dia
% z$ j/ o% U5 @' R) \! q) Pler1 has turned into UP state.
[pppoe-client-Dialer1]ip add       
7 N) `% s  Q3 w[pppoe-client-Dialer1]ip address ppp       
[pppoe-client-Dialer1]ip address ppp-negotiate  #地址采用ppp协商

. C  U) w- u  v4 f[pppoe-client]interface Dialer 1                #创建接口拨号组1
# c4 t- J+ S1 X2 Y[pppoe-client-Dialer1]ip address ppp-negotiate  #ip地址采用ppp协商
[pppoe-client-Dialer1]dialer user zhprny        #此用户不用于认证，是标识作用以及和dialer绑定
+ d9 |$ ?; P- P& U% z  P  \* K[pppoe-client-Dialer1]dialer bundle 1           #设备通过Dialer bundle将物理接口与拨号接口关联起来。
( F% j/ F) D( t4 J  F[pppoe-client-Dialer1]dialer-group 1             #放到一个拨号访问组1中
5 z- f2 r- q3 B& h/ ?6 W: A8 ^2 H[pppoe-client-Dialer1]ppp chap user pokes        #指定dialer1接口的编号，拨号账号
6 f: ?6 Z  W) z0 |[pppoe-client-Dialer1]ppp chap password 123456   #拨号的密码
! R3 n0 N0 Y8 H6 D" i7 y

" j7 {6 j/ ?- Y; C5 R[pppoe-client-Dialer1]dis th
7 V+ G( c) ?" [9 V4 P[V200R003C00]
- T! ^3 F, T( e" t( d% r6 q6 j) d9 a#
interface Dialer1
link-protocol ppp
$ j+ @% R, w+ D; A9 R  r ppp chap user pokes
4 N& b; v$ S  Y+ e: G# k$ l" D( _ ppp chap password cipher %$%$I/!'WCyd<7p[~8;,>51L,$sl%$%$
+ B; k# D% E3 f" \( J1 c ip address ppp-negotiate
dialer user zhprny
dialer bundle 1
0 j+ N6 S4 P4 x+ T. `4 g dialer-group 1

[pppoe-client-GigabitEthernet0/0/0]
Jul 15 2021 19:07:54-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[0]:The line pr
otocol PPP on the interface Dialer1:0 has entered the UP state.  #PPP已进入启动状态
[pppoe-client-GigabitEthernet0/0/0]
: E: n1 ^' h0 ?* e+ OJul 15 2021 19:07:54-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[1]:The line pr
; R- m& Z8 F3 _. Votocol PPP on the interface Dialer1:0 has entered the DOWN state. #PPP已进入关闭状态
" c2 s! k6 v8 S- ]' P5 X
& t* u8 B% j7 Z; M9 S8 F#不停的循环。。。。

+ m- c" e& F  z7 I0 f8 h( s
, X1 l$ z/ w3 E! k' I#原因是没有认证成功，因为我们在PPPOE-server上面还没有创建认证用户和密码
# h) `5 E0 [% J% |  t# I
: T$ p" F  n: n5 o7 Y1 _; v三、pppoe服务器上新建认证用户
; x/ t3 t  W& x+ j% Y- r& l我们到服务器上直接新建认证用户：

( e% y7 ~8 @* O" {* f2 c[pppoe-server]aaa
" T4 H" t8 y8 o7 k( p1 ~[pppoe-server-aaa]local-user pokes password cipher 123456
Info: Add a new user.
[pppoe-server-aaa]local-user pokes service-type ppp    #类型为ppp
: i# R8 `: x. C" w# Q

四、客户端验证结果
2 F+ o9 G2 r# a( K1 ~1、认证成功信息
然后客户端就会出现认证成功的提示：

[pppoe-client-GigabitEthernet0/0/0]
  E$ m2 j9 A( d( i/ P% N2 p! }* G& CJul 15 2021 19:09:23-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[10]:The line p
; F# G. n7 S. s1 I0 Y- \& u5 [rotocol PPP on the interface Dialer1:0 has entered the UP state.
[pppoe-client-GigabitEthernet0/0/0]
7 P8 v( f" }3 F. \8 o5 OJul 15 2021 19:09:23-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[11]:The line p
rotocol PPP IPCP on the interface Dialer1:0 has entered the UP state.
[pppoe-client-GigabitEthernet0/0/0]q
[pppoe-client]dis ip in b
*down: administratively down
2 w1 G4 S% ~8 ?" g. ?/ c6 {. f& D^down: standby
: N5 [* l8 `$ Z' p$ {(l): loopback
(s): spoofing
The number of interface that is UP in Physical is 4
5 N  ~+ H$ d  @) lThe number of interface that is DOWN in Physical is 0
- t% b/ t  ^1 B- H, ]4 S0 T& C4 K% pThe number of interface that is UP in Protocol is 3
The number of interface that is DOWN in Protocol is 1
6 I) m  c# J/ `, K4 U9 M; C- ?
Interface                         IP Address/Mask      Physical   Protocol  
Dialer1                           10.1.12.254/32       up         up(s)     #拿到了PPPOE服务器上的地址
GigabitEthernet0/0/0              unassigned           up         down      
. R7 K, A: S* J6 }1 f7 KGigabitEthernet0/0/1              192.168.1.254/24     up         up        
NULL0                             unassigned           up         up(s)
1 [, o: m+ x! u& x

9 d9 Q* I9 i" U$ J2、pppoe-server 信息
! M. y2 E1 E" f; y6 m8 u! ~, O<pppoe-server>dis interface Virtual-Template 1
Virtual-Template1 current state : UP
Line protocol current state : UP
Last line protocol up time : 2021-07-15 19:09:22 UTC-08:00
Description:HUAWEI, AR Series, Virtual-Template1 Interface
; Y+ \: ^$ L! c5 B+ m2 I% FRoute Port,The Maximum Transmit Unit is 1492, Hold timer is 10(sec)
Internet Address is 10.1.12.2/24
Link layer protocol is PPP
9 [6 {% Q- t# }& |3 zLCP initial
' L! y% \1 C, p" ZPhysical is None
Current system time: 2021-07-15 20:27:28-08:00
    Last 300 seconds input rate 0 bits/sec, 0 packets/sec
    Last 300 seconds output rate 0 bits/sec, 0 packets/sec
    Realtime 0 seconds input rate 0 bits/sec, 0 packets/sec
0 F) z5 l9 q* i    Realtime 0 seconds output rate 0 bits/sec, 0 packets/sec
% J- c5 _! G# B+ o0 f3 `- a/ c    Input: 0 bytes
6 E( ?% V% G: H4 @# [2 y5 e! s& W0 e* \: V    Output:0 bytes
5 ~- @9 S  r! v  D" ?    Input bandwidth utilization  :    0%
* Q# D8 u$ {) g. U" [5 b    Output bandwidth utilization :    0%

<pppoe-server>
/ ~6 Q% p- M6 V8 r: G1 s+ [

3、pppoe-client信息
<pppoe-client>dis interface Dialer 1
0 L/ \' |  s( O$ u3 H( b9 cDialer1 current state : UP
- z: f2 L' D2 b; x% F4 N8 m* fLine protocol current state : UP (spoofing)
Description:HUAWEI, AR Series, Dialer1 Interface
Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
Internet Address is negotiated, 10.1.12.254/32
Link layer protocol is PPP
6 V: {3 ~' K  x9 G. NLCP initial
Physical is Dialer
7 J+ `; E% o# T; |Current system time: 2021-07-15 20:23:56-08:00
* W# j/ A) U4 b. t$ O; @    Last 300 seconds input rate 0 bits/sec, 0 packets/sec
    Last 300 seconds output rate 0 bits/sec, 0 packets/sec
    Realtime 0 seconds input rate 0 bits/sec, 0 packets/sec
    Realtime 0 seconds output rate 0 bits/sec, 0 packets/sec
    Input: 0 bytes
+ [/ u7 Y+ y* D1 b7 A- J+ S    Output:0 bytes
    Input bandwidth utilization  :    0%
    Output bandwidth utilization :    0%
Bound to Dialer1:0:
Dialer1:0 current state : UP ,
9 A8 A/ L+ p" V% ^: aLine protocol current state : UP

Link layer protocol is PPP
LCP opened, IPCP opened
Packets statistics:
4 ~& l9 p6 _3 h& O  Input packets:0,  0 bytes
  Output packets:4, 336 bytes
7 B- b* I, r, {' ^; |  FCS error packets:0
* _- w# E9 o( I6 E  Address error packets:0
  Control field control error packets:0


<pppoe-client>

五、NAT的配置
4 w. c* S' u" ]' i* a/ i用PC2直接ping 10.1.12.254是可以通的。10.1.12.254是AR1的g0/0/0口获取到的地址，其实就是我们常说的WAN口地址。
+ v6 w8 ^" r; P" m6 q* c6 ?1 n1 q
PC2>ping 10.1.12.254

, \. k( l0 I/ H* W  g1 s  U  NPing 10.1.12.254: 32 data bytes, Press Ctrl_C to break
4 A6 u8 N2 k/ \; mFrom 10.1.12.254: bytes=32 seq=1 ttl=255 time=63 ms
1 M4 F0 w' N1 r' p0 @5 L0 fFrom 10.1.12.254: bytes=32 seq=2 ttl=255 time=31 ms
From 10.1.12.254: bytes=32 seq=3 ttl=255 time=47 ms
From 10.1.12.254: bytes=32 seq=4 ttl=255 time=31 ms
8 V! J4 y* X1 K# T# kFrom 10.1.12.254: bytes=32 seq=5 ttl=255 time=47 ms

--- 10.1.12.254 ping statistics ---
  5 packet(s) transmitted
: i7 \% P% `" {  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 31/43/63 ms
% R) b1 L# b5 b( {+ Y0 Z  {
3 E6 _6 n$ a! Y  y/ ?2 O; OPC2>ping 10.1.12.2
0 ~& `  ^$ ]/ c: m# n/ m# i
! g! q  S/ |  n! n, GPing 10.1.12.2: 32 data bytes, Press Ctrl_C to break
7 g' W! a3 E& J( ~Request timeout!
Request timeout!
Request timeout!
6 n5 b1 h5 y+ p8 h% m' |8 ZRequest timeout!
- f9 |# N5 E' qRequest timeout!
) @  J6 O$ L5 |
/ c6 M; c% R) e; w1 V7 N1 s' O--- 10.1.12.2 ping statistics ---
4 o# ?6 N. P3 W4 Q2 C& [" x$ V; f  5 packet(s) transmitted
  0 packet(s) received
  100.00% packet loss
* m4 c, J% O( F# G' o#但是无法ping通10.1.12.2
# U. l# ~' J0 Z- r0 i
0 n& a9 |2 r- ]  Z1 L/ `8 `: H
无法ping通10.1.12.2的原因是：我们没有做NAT .接下来我们在pppoe-client上面做NAT
( y9 c' r" f' w* P6 A( }
1、这里配置规则2000
[pppoe-client]acl number 2000       
[pppoe-client-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255

2、将规则2000绑定到接口
如下接口信息，需要注意的是pppoe的接口是Dialer1，并不是GigabitEthernet0/0/0口。我们必须将规则绑定在Dialer1口，最容易犯错的就是直接绑定在g0/0/0口。

3 Q% [- V& E8 Z, z[pppoe-client]dis ip int b
% H$ x, I8 Y# d8 ^/ T! b*down: administratively down
* x- E. k' D. H" s^down: standby
$ ?+ V' D/ c$ B3 v0 e# w(l): loopback
(s): spoofing
The number of interface that is UP in Physical is 4
The number of interface that is DOWN in Physical is 0
The number of interface that is UP in Protocol is 3
% |# N* Z; r: W4 tThe number of interface that is DOWN in Protocol is 1
$ x& |4 D" L. }0 N% D
* m7 _* E; m. NInterface                         IP Address/Mask      Physical   Protocol  
6 k" u, @  I" u5 v7 a( h0 \Dialer1                           10.1.12.254/32       up         up(s)     
GigabitEthernet0/0/0              unassigned           up         down      
GigabitEthernet0/0/1              192.168.1.254/24     up         up        
! N+ W4 b, o' `1 P1 D- `' _' Z1 xNULL0                             unassigned           up         up(s)     
[pppoe-client]

! ?; A( P& q7 \[pppoe-client]int Dialer 1       
[pppoe-client-Dialer1]nat outbound 2000
[pppoe-client-Dialer1]dis th
' r) h1 k9 R/ C* {8 Z$ X5 a[V200R003C00]
6 j( d2 S( G9 {3 @#
interface Dialer1
! O( d% x1 Z  F6 D link-protocol ppp
ppp chap user pokes
6 i+ L5 _1 C/ g ppp chap password cipher %$%$I/!'WCyd<7p[~8;,>51L,$sl%$%$
ip address ppp-negotiate
8 a* ^8 M( \" W5 J7 @ dialer user zhprny
; Y7 X4 c0 V3 S dialer bundle 1
dialer-group 1
nat outbound 2000
#
return
[pppoe-client-Dialer1]

接下来我们就可以ping通10.1.12.2 了。

% h: z9 I) c& T8 p9 \- jPC2>ping 10.1.12.2

9 j. m8 t& S$ O* x1 ?5 X* ?6 qPing 10.1.12.2: 32 data bytes, Press Ctrl_C to break
From 10.1.12.2: bytes=32 seq=1 ttl=254 time=31 ms
  Y9 e5 ]: i0 z9 i- `From 10.1.12.2: bytes=32 seq=2 ttl=254 time=32 ms
From 10.1.12.2: bytes=32 seq=3 ttl=254 time=46 ms
9 B) C% G1 @0 q' K. k% {( cFrom 10.1.12.2: bytes=32 seq=4 ttl=254 time=32 ms
" j3 Z2 c3 A! c) [( K: R+ VFrom 10.1.12.2: bytes=32 seq=5 ttl=254 time=31 ms

--- 10.1.12.2 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
/ {3 Z' Z. q. |5 y0 Q- O5 B0 [/ V/ D  0.00% packet loss
  round-trip min/avg/max = 31/34/46 ms

1 \. g  @1 L0 A" p- ]+ ~5 e" D
0 z$ i/ n7 N$ c