找回密码
 注册
查看: 1121|回复: 1

华为路由器:PPPOE配置模拟实验及NAT配置

[复制链接]

1

主题

0

回帖

12

积分

管理员

积分
12
QQ
发表于 2022-3-16 09:39:13 | 显示全部楼层 |阅读模式
实验环境
. n2 Q) K+ v+ u# {5 s% \( K
, p9 J1 ~) r5 G* Rpppoe-client上面的接口信息
2 l  }2 }  P. |* g% I$ N
* Z* d. ]7 u  l' u$ b[AR1]dis ip interface brief : I* b1 J, c! }# m* f3 i
*down: administratively down
) ?" ?7 G0 ^) l1 p+ J, a^down: standby6 D* F2 G8 f8 o; C: G% Z9 a8 E
(l): loopback
# ?$ i6 b5 e1 K3 A(s): spoofing0 f& u1 s1 T! h& p: i! f
The number of interface that is UP in Physical is 2+ A) K/ ^/ q# a' \
The number of interface that is DOWN in Physical is 1
% S, x; D! k- I" {3 g7 NThe number of interface that is UP in Protocol is 1# C% j# ]& l. Y( E2 O3 \1 Y6 y7 C! _
The number of interface that is DOWN in Protocol is 2  e6 d: ~# H8 @9 [
, T4 p4 y7 Z( K" B9 ]# O, B. R$ F
Interface                         IP Address/Mask      Physical   Protocol  6 X# E. u, Q( S" @
GigabitEthernet0/0/0              unassigned           up         down      
# j$ n  \! W& L6 ?, g9 Z: u* }GigabitEthernet0/0/1              192.168.1.254/24     down       down      
- z3 \0 T" P' r1 n5 o9 U; z2 x* q$ `NULL0                             unassigned           up         up(s)     
& g) x* T: W$ n1 y3 f9 \0 }
5 P% l; u3 Q/ }3 ]8 B' x- J' [- g# t( B; o: O& S0 ~% p# n6 i
配置了基于接口的DHCP
7 Y: ~9 t9 y+ ^+ t; S0 [; ]: n* _' }& L# _2 h
interface GigabitEthernet0/0/1+ r; W) M5 ], F9 V- {
ip address 192.168.1.254 255.255.255.0
; |/ R) ~& [& L& L dhcp select interface
0 q8 M3 S8 `% l5 H; b1 m dhcp server dns-list 8.8.8.8 / l) _+ o/ u! k- ^+ A! i( k
dhcp server domain-name pokes.com. k1 y. s% m; G, r
4 ^$ t3 G3 F/ C" A6 r, A; Y
注意事项:AR1、AR2的物理接口g0/0/0不配地址.
5 U2 ~: I7 X' u+ F- V, ^: y
7 N  p# p. Q: B. u) G" N& x一、pppoe-server的配置
& u) ?. @, d/ C$ l# ]1、pppoe-server 配置地址池! \7 B, f: z8 z; g8 u9 [( v) g. D
[pppoe-server]ip pool pokes            #创建名为pokes的地址池,名字可以随便起,后面要调用
$ {) X3 |  N) Q8 l% M* DInfo: It's successful to create an IP address pool.4 d0 j7 Q5 g. l0 d
[pppoe-server-ip-pool-pokes]network 10.1.12.0 mask 24   #地址池为10.1.12.0/24- b+ W3 Z7 j  D1 p3 ]0 O) I8 E
[pppoe-server-ip-pool-pokes]dis th
! K% j0 n; f. u6 b7 p. X[V200R003C00], w! U" d2 T, `3 {3 u2 F
#
  B$ a/ E( l9 Pip pool pokes6 k! C. B3 H. Y9 [; f
network 10.1.12.0 mask 255.255.255.0 7 O* d+ j8 ~9 t6 A
#1 S, g2 I" r2 a
return! O$ x! |- I1 _% W: Z% }
[pppoe-server-ip-pool-pokes]q' Q. {# N9 Z& J3 h
" b2 H+ t3 B, m/ u
2、配置虚拟口关联地址池- j  ~8 s5 u' w7 E# M" V1 f
配置虚拟口关联地址池,即创建Virtual-Template 1模版。
& v8 D5 L1 V* z7 V4 V! l! e+ k: W4 D0 f
[pppoe-server]interface Virtual-Template 1    #创建虚拟接口1
+ ~7 D# U, e4 v& S( u  `[pppoe-server-Virtual-Template1]ip add 10.1.12.2 24                   #虚拟接口1的地址) u6 z8 k7 O# Q( |% h4 l: F+ ^
[pppoe-server-Virtual-Template1]ppp authentication-mode chap   #认证类型
" ~: j7 a& A$ w- F" ]- ?; |! T[pppoe-server-Virtual-Template1]remote address pool pokes      #客户端的地址池pokes! k( H2 J. e/ S* G# F
[pppoe-server-Virtual-Template1]dis th
/ }/ i9 ~0 ^6 r, |/ k. finterface Virtual-Template1
( E4 S2 N7 ~/ P, T3 S. V ppp authentication-mode chap $ F& a  X. R& c2 L2 ]2 ]
remote address pool pokes
9 J1 J+ [" A1 l# o+ O1 E2 W ip address 10.1.12.2 255.255.255.0
2 R$ f( Z' W: A" x# A7 o4 t4 m( f; q$ t4 w( N' t. e& T
[pppoe-server]int g0/0/0       
2 g% w4 _. Z/ o[pppoe-server-GigabitEthernet0/0/0]pppoe-server bind virtual-template 1   #将虚拟接口1关联到g0/0/0接口
3 e' }) h* Z2 O' v[pppoe-server-GigabitEthernet0/0/0]dis th4 v9 o$ G& y/ e0 K, I7 Z# X- ~
[V200R003C00], }; C! j% Y: b& \8 J2 i2 |% }
#; l% K( h% U$ x/ Q: q$ Z
interface GigabitEthernet0/0/0
9 Z' O9 Y( W7 F2 m: g  N pppoe-server bind Virtual-Template 1  M; D2 N4 C; m: `/ y& ?+ P$ E
#' Z1 F3 ~% a- E' O# x2 t& y( ^
return
3 y: h" k& E/ r8 ~- D6 X! j[pppoe-server-GigabitEthernet0/0/0]2 o6 m, n( i' C

/ r/ n- v, O! {% m, S3、创建pppoe拨号的账号
; H, G- M7 G4 A, n, a! K5 @2 R2 \按理我们应该创建pppoe拨号的账号。
- V- _& F' \! u" W' Z  T5 _这里为了演示拨号失败,我们这里先不新建账号,后面再新建。
1 r. R! B4 w/ }8 ]" F6 [  n' i9 N& X' E8 Y. y6 e+ P* s
二、pppoe-client的配置
/ I) H- W: ]3 c6 `, u" t[pppoe-client]dialer-rule   
7 c+ n- T1 t% w8 v; q0 F[pppoe-client-dialer-rule]dialer-rule 1 ?
+ b( @5 U  e) e$ t+ _- \7 s  acl   Permit or deny based on access-list   
; g+ E0 Y( _/ e5 H; K7 u- a  ip    Ip1 i: t; H8 F  Y% I5 q! p) v0 |9 O
  ipv6  Ipv6       
6 c5 Y9 N" Z& p' [1 d  O[pppoe-client-dialer-rule]dialer-rule 1 ip permit   #创建拨号规则,允许ip流量触发拨号7 k$ U2 T4 b0 K0 i% ~7 x

# k/ G) X+ Z4 {( E7 u, G, L: o[pppoe-client]interface Dialer 1' B) i8 g# N- j1 g) m  p# l5 x
Jul 15 2021 18:55:22-08:00 pppoe-client %%01IFPDT/4/IF_STATE(l)[0]:Interface Dia0 e; `' h, _- ?* b( V. `
ler1 has turned into UP state.! g: E- p5 e$ q( u
[pppoe-client-Dialer1]ip add       
/ Z* {1 L  Y: M% W/ D. R% S" V7 z[pppoe-client-Dialer1]ip address ppp       
- J$ V) L  R0 y  S7 q9 f[pppoe-client-Dialer1]ip address ppp-negotiate  #地址采用ppp协商( {) j; F0 T3 ?: W: m/ Y
2 a) F2 F/ z5 S9 a7 w/ }( Y, ~
[pppoe-client]interface Dialer 1                #创建接口拨号组1" X* k1 ?% O/ G0 D6 _
[pppoe-client-Dialer1]ip address ppp-negotiate  #ip地址采用ppp协商
0 ~$ k& O& W; n0 _[pppoe-client-Dialer1]dialer user zhprny        #此用户不用于认证,是标识作用以及和dialer绑定
) s) q% _) \! A" f. g* Y[pppoe-client-Dialer1]dialer bundle 1           #设备通过Dialer bundle将物理接口与拨号接口关联起来。. G) A$ o: n. W/ @, {
[pppoe-client-Dialer1]dialer-group 1             #放到一个拨号访问组1中
  |7 x0 |& A3 F+ e2 C6 H[pppoe-client-Dialer1]ppp chap user pokes        #指定dialer1接口的编号,拨号账号
, T$ c5 J% x. a; R6 ~+ D1 b[pppoe-client-Dialer1]ppp chap password 123456   #拨号的密码
& e7 g8 d' E6 M
1 I- s* s2 O; Y% u" }
9 m8 |8 C7 k% E# [[pppoe-client-Dialer1]dis th* }0 d  q/ W1 w& x5 ?1 e
[V200R003C00]
, W) G* a8 _1 ]$ l% O; `; P#% J- J' g5 h! ?, m9 ^" B& l
interface Dialer1
' g- X* w* b3 J0 \) e/ i2 r link-protocol ppp8 Y/ L9 Y+ A" r5 m* H4 @
ppp chap user pokes, h2 Y. m2 \. d/ M1 L- Q* ^
ppp chap password cipher %$%$I/!'WCyd<7p[~8;,>51L,$sl%$%$! n/ \) ^( `" e, I+ M! h1 t
ip address ppp-negotiate( I3 M0 D( Y$ M6 K, N' q$ k, j
dialer user zhprny
" m7 z7 u+ u. ]/ a0 Z, L2 B3 _! W dialer bundle 1
/ i9 z1 |. f( g4 ]* [ dialer-group 1# Q8 o; r4 a4 Q/ {' N% h
  P% q  M+ r" _8 d' q
[pppoe-client-GigabitEthernet0/0/0]
6 s# D1 J" Z% U! v- r( F$ J  ~Jul 15 2021 19:07:54-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[0]:The line pr) N& d0 N5 Y+ L: O
otocol PPP on the interface Dialer1:0 has entered the UP state.  #PPP已进入启动状态
8 i& F5 }- u$ n1 ~8 q; n[pppoe-client-GigabitEthernet0/0/0]
! B* E2 j: T2 [) H- sJul 15 2021 19:07:54-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[1]:The line pr
( i  W0 F1 I: w* T, j3 {otocol PPP on the interface Dialer1:0 has entered the DOWN state. #PPP已进入关闭状态
0 g# O7 n+ J) {3 w
5 I2 H6 r' i* d#不停的循环。。。。% }1 ^, v! @5 t3 K$ Q) Z& _

" W4 N, |- y5 s9 K( t1 g; g5 y4 }$ G* V: S& m4 m3 w
#原因是没有认证成功,因为我们在PPPOE-server上面还没有创建认证用户和密码; L4 K$ M& ~5 j8 E

$ r( X2 t- m% Q6 ]) H+ E3 z3 ~三、pppoe服务器上新建认证用户; }3 J0 F8 p* M2 O( K
我们到服务器上直接新建认证用户:
) H" f! |7 z+ `. P% d( r7 Z  R
" P: J5 x& k. M) E[pppoe-server]aaa* ]. j' V% C/ f; e7 Q" H
[pppoe-server-aaa]local-user pokes password cipher 123456
3 V7 g6 h3 p( l' `$ FInfo: Add a new user., {% E% X, k' @7 B, t; ?3 N- a
[pppoe-server-aaa]local-user pokes service-type ppp    #类型为ppp, J9 s. T. X* r1 L5 ]
6 l2 h. K% _  F

7 v3 |! m5 L1 j5 B四、客户端验证结果" @/ G7 M; C$ e% N% A
1、认证成功信息
$ W0 t8 Z( N/ s" S' {- z- r$ k然后客户端就会出现认证成功的提示:
: l5 C+ W. e9 g1 n/ h/ z
7 A7 \7 `, }1 O5 Z% h[pppoe-client-GigabitEthernet0/0/0]
5 r6 f0 ~/ ]! F, Q% L6 cJul 15 2021 19:09:23-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[10]:The line p2 N" D/ M7 h# N- f  s
rotocol PPP on the interface Dialer1:0 has entered the UP state.
2 r# Z( |) d0 j[pppoe-client-GigabitEthernet0/0/0]. m2 y; `  N4 D, o; N  t
Jul 15 2021 19:09:23-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[11]:The line p
" _+ M' L0 O/ q, |7 o5 c9 vrotocol PPP IPCP on the interface Dialer1:0 has entered the UP state.
' I0 _: @2 x; }[pppoe-client-GigabitEthernet0/0/0]q' b, d% c3 B# z" n+ C; n: i
[pppoe-client]dis ip in b
7 A; {, ]9 P" F  H# [2 ]4 z*down: administratively down
' r! f4 C% Y* J* Y: h2 j! |) t^down: standby( V  N" x5 q) e
(l): loopback7 k: t0 s3 \5 `. ?1 K
(s): spoofing
: q6 u8 {- Q- XThe number of interface that is UP in Physical is 4) `5 q4 R. H0 C: b- O
The number of interface that is DOWN in Physical is 0: `( p+ Q" T/ X! S' n
The number of interface that is UP in Protocol is 3# s# v8 g3 D% I. r& d" f8 t3 D
The number of interface that is DOWN in Protocol is 1
8 c1 i$ Z  X1 x& k# V9 j
0 o7 w2 V+ V! J7 rInterface                         IP Address/Mask      Physical   Protocol  
8 f* M& B7 f5 K' ]Dialer1                           10.1.12.254/32       up         up(s)     #拿到了PPPOE服务器上的地址
" u* f; D5 C! A8 IGigabitEthernet0/0/0              unassigned           up         down      
* O7 d" g- J8 K3 L4 p: t$ FGigabitEthernet0/0/1              192.168.1.254/24     up         up        
7 Y4 d9 k& }$ Z- jNULL0                             unassigned           up         up(s)
, G& P  @( n% w3 D6 L0 [* F2 \& s

& _& M7 A2 [8 a2、pppoe-server 信息
* n1 C- d" f: S- G! F( K1 y<pppoe-server>dis interface Virtual-Template 1
) w1 B8 l2 f6 K9 ?9 m7 k9 \Virtual-Template1 current state : UP8 y5 U+ m" m" a% P3 D  _
Line protocol current state : UP
. y; j: o6 M5 N3 i' R  ?) H# h& rLast line protocol up time : 2021-07-15 19:09:22 UTC-08:00
" b( v  q5 f" w* F) B9 _Description:HUAWEI, AR Series, Virtual-Template1 Interface4 r" o* H. g/ N/ k5 r. b; g6 Y$ w
Route Port,The Maximum Transmit Unit is 1492, Hold timer is 10(sec)8 t5 x6 o1 p5 w* N. V
Internet Address is 10.1.12.2/24: @* L$ [  |0 }, V. h2 F+ a; K
Link layer protocol is PPP
% @, P" O6 o. r: PLCP initial4 W: ?3 ]: M; z% y1 r; h
Physical is None
% ~" g) l- w2 NCurrent system time: 2021-07-15 20:27:28-08:00
2 Z. l8 a& N" S. u' I2 o    Last 300 seconds input rate 0 bits/sec, 0 packets/sec
2 e* g$ [: E) ^7 {. w    Last 300 seconds output rate 0 bits/sec, 0 packets/sec
) g4 t& V4 a* v    Realtime 0 seconds input rate 0 bits/sec, 0 packets/sec
9 k. l7 N6 v! M1 X2 A4 t! F# A    Realtime 0 seconds output rate 0 bits/sec, 0 packets/sec
" y2 Q6 c, n& Q; N    Input: 0 bytes; h% w" f- R5 @/ q
    Output:0 bytes4 m# B5 J# S7 M$ H. A$ P1 `* Q
    Input bandwidth utilization  :    0%- N2 R' `. G. i: K1 e+ ^+ m) E  `6 \
    Output bandwidth utilization :    0%
/ A+ |& c) [2 t; U" p
0 Z! G1 Z/ h# d/ F. h<pppoe-server>
9 F2 V5 K1 }0 c8 p( r
: o# `  t, v2 A$ R0 I, ?6 a, ^, a$ s" a4 M5 g3 Z
3、pppoe-client信息  a) W' G  X* c0 z2 D8 }
<pppoe-client>dis interface Dialer 1
3 m: m, ~, {3 u9 ~Dialer1 current state : UP% [1 ]. O7 n6 e4 N) e7 P+ c2 U  w/ ^$ j
Line protocol current state : UP (spoofing)8 p) F1 q3 t2 c+ {+ ?% i7 c
Description:HUAWEI, AR Series, Dialer1 Interface& n4 {( J9 W% C: ~
Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)$ e; Q( S2 s/ U: Y* ^9 c. F' i
Internet Address is negotiated, 10.1.12.254/32
3 ~8 G# U5 i8 X+ O! v/ R( s1 _Link layer protocol is PPP. q) K7 e+ ]% J! l
LCP initial
5 i& T7 f2 `3 M% y: G/ JPhysical is Dialer& k' K2 q/ B# b0 o6 r& I
Current system time: 2021-07-15 20:23:56-08:00  J) U, [, C; |' w# P
    Last 300 seconds input rate 0 bits/sec, 0 packets/sec
: Q/ H; `) f+ r! ~9 c' Y    Last 300 seconds output rate 0 bits/sec, 0 packets/sec
- e. A* E# @/ N! u8 d, ^) c    Realtime 0 seconds input rate 0 bits/sec, 0 packets/sec. |/ }# c1 }9 m5 H
    Realtime 0 seconds output rate 0 bits/sec, 0 packets/sec
9 {- X- B& B& S* W    Input: 0 bytes0 Y4 Z- L8 A' T" I
    Output:0 bytes
% ~$ c  q: H3 A/ Y; p, _    Input bandwidth utilization  :    0%. D% w) O7 K  ]
    Output bandwidth utilization :    0%) {& O' \! f4 D$ K1 x
Bound to Dialer1:0:- o* K* Z' x  @4 Y& h
Dialer1:0 current state : UP ,7 T1 _+ r" x5 g
Line protocol current state : UP7 A: O0 L, l1 P9 D# i4 F3 m3 u
9 e. |: u+ Z1 w5 |6 P
Link layer protocol is PPP% I6 T& o+ l4 K" i" x
LCP opened, IPCP opened* A5 y; {& `) p# A4 x4 E& J" D; m$ T4 X
Packets statistics:  n; I/ x+ P* h* B& C5 x; q
  Input packets:0,  0 bytes
, U/ b9 u2 K+ C/ h- b& u  Output packets:4, 336 bytes
1 ~/ g# L  z) J; q2 T6 @4 J  FCS error packets:0* n) J$ n3 I' K" y7 U
  Address error packets:0
3 \) M' Z! z/ R' `6 M, l  Control field control error packets:0  d+ J( W5 [& X  p! k

$ U5 l/ y7 J1 T9 e
  J+ P4 I. v! Q1 v<pppoe-client>
4 I4 h- h- r: u/ R
& v; J" L6 U+ w五、NAT的配置
; j. b) H8 a3 X) H6 t; s% O用PC2直接ping 10.1.12.254是可以通的。10.1.12.254是AR1的g0/0/0口获取到的地址,其实就是我们常说的WAN口地址。  a1 B# H) o4 Z, |* S3 Q5 \+ t

0 B+ p: L! U  \  a9 |+ `" EPC2>ping 10.1.12.254
( Y* x1 ]3 a8 ?. @2 i% R+ W# y, d( O. P# {3 S$ E/ d! K
Ping 10.1.12.254: 32 data bytes, Press Ctrl_C to break
2 \' ]( p; t2 d4 z* D3 H" CFrom 10.1.12.254: bytes=32 seq=1 ttl=255 time=63 ms- r$ `/ Z9 x' b# v. \
From 10.1.12.254: bytes=32 seq=2 ttl=255 time=31 ms7 P) z1 F8 M. r) j/ q
From 10.1.12.254: bytes=32 seq=3 ttl=255 time=47 ms
  ?: w+ t, R3 GFrom 10.1.12.254: bytes=32 seq=4 ttl=255 time=31 ms
* F4 d2 S9 C  ~/ IFrom 10.1.12.254: bytes=32 seq=5 ttl=255 time=47 ms
" \  e' x; y6 z! y( S( V. k
) q- Q, i& F7 z3 Y( f5 Y--- 10.1.12.254 ping statistics ---
, C0 T3 t( `( P) Z4 S  5 packet(s) transmitted0 h3 _1 n5 ]; L" r3 H
  5 packet(s) received
$ n4 P( X4 ~% p% z) X9 t. O, V  0.00% packet loss
$ a8 k% [4 }! n/ K. z  round-trip min/avg/max = 31/43/63 ms
+ y+ r' F# I5 i2 J) A" h# H- }, p3 V
PC2>ping 10.1.12.2
+ c7 {2 A% Z! f9 e1 h1 X0 H) M2 ]; @: w2 R( h
Ping 10.1.12.2: 32 data bytes, Press Ctrl_C to break
7 @1 K- q6 C2 X9 T  zRequest timeout!/ x# Y) m5 {* W, H- i! Z' C+ [/ h
Request timeout!
5 k9 J# h. J/ x4 h# C- CRequest timeout!
! J# U* j! m( g* S- BRequest timeout!
, A. m9 `8 n9 d4 \' {Request timeout!& ^/ j" T1 ~& D& C& X

/ P/ ~$ a3 d- c5 y9 k  C& O+ E--- 10.1.12.2 ping statistics ---
% Y+ {; f9 W3 F. a  5 packet(s) transmitted
; o+ l5 J3 P3 @$ o0 G9 O7 U  0 packet(s) received. H# [/ N6 e6 O, T5 u
  100.00% packet loss; E# D6 n. C% e' g7 n+ b. [
#但是无法ping通10.1.12.2
. W' [8 a! C! g( _, X
6 L! S' U- C& z; B# P* C7 n+ I8 S2 C. D! C
无法ping通10.1.12.2的原因是:我们没有做NAT .接下来我们在pppoe-client上面做NAT
/ K: z) t$ Q2 `5 y& N) F, y6 T$ C* X8 ~5 _& s( U
1、这里配置规则2000% M$ q$ D& ~' x3 {+ ?* R
[pppoe-client]acl number 2000        ' M$ J  `- T7 B: k, u. x6 q) ?
[pppoe-client-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
  Z& g- {: H/ H# x
/ N4 v( ]$ g) z$ P7 j3 k, J2、将规则2000绑定到接口$ Q$ r3 Z( u4 W% I+ f4 m* S
如下接口信息,需要注意的是pppoe的接口是Dialer1,并不是GigabitEthernet0/0/0口。我们必须将规则绑定在Dialer1口,最容易犯错的就是直接绑定在g0/0/0口。
3 G6 ?. j. t' b/ Y7 B! a. u4 n( G3 h9 h0 p# S
[pppoe-client]dis ip int b; I, P( E* {2 p& Q# ~7 O1 j, I! j. ?0 B
*down: administratively down
, e% e6 U& ^3 x" N2 B* H$ V( B: `: t^down: standby
0 d/ u# y8 E/ {2 ?(l): loopback
) M4 ~  O+ o1 l/ H0 B& ?. I6 H(s): spoofing
' Z, v  a' i1 `/ L% EThe number of interface that is UP in Physical is 40 _1 ], _7 I$ N
The number of interface that is DOWN in Physical is 0
2 H2 T) F: Q1 U7 p; pThe number of interface that is UP in Protocol is 39 H  g: ~" ~, i; E5 `2 j
The number of interface that is DOWN in Protocol is 1
! \; I5 ~9 K/ ]3 m( |5 P; N) f
- H' u" C) G& k0 ], u: ]5 qInterface                         IP Address/Mask      Physical   Protocol  
: h6 @, m- R$ k) j7 M) UDialer1                           10.1.12.254/32       up         up(s)     ' b9 q/ r, Z$ k  k
GigabitEthernet0/0/0              unassigned           up         down      8 Y1 v, Q' h; U2 O5 Z1 E7 f
GigabitEthernet0/0/1              192.168.1.254/24     up         up        . A9 p& ?- J6 z' Z& i, E- L* v0 `
NULL0                             unassigned           up         up(s)     
, D1 M4 p& Z$ j* v9 b! ?7 e[pppoe-client]
5 V1 {* H$ O1 c6 |: u& ~2 L( V/ j5 W  m2 D9 L! r, p: l3 N
[pppoe-client]int Dialer 1        - ]! P# r; U' `1 ^) I2 W/ q0 i
[pppoe-client-Dialer1]nat outbound 20005 o, y4 s- ~: E, A; t
[pppoe-client-Dialer1]dis th" g8 ?7 M4 u# y
[V200R003C00]
, M1 l( v6 Y/ E( p) w#
; E9 f( X' \8 A+ J9 }# _interface Dialer1& w! w8 n$ E$ p
link-protocol ppp  b2 s# X+ A3 p# O% g9 j
ppp chap user pokes; ]7 I5 O' N* o3 R7 ]+ N6 y
ppp chap password cipher %$%$I/!'WCyd<7p[~8;,>51L,$sl%$%$
+ U  W0 H% X0 c! x3 O- h ip address ppp-negotiate1 X) O8 X  m$ D8 w% M9 A* x
dialer user zhprny
. D3 O7 {, C/ ~  b0 q/ e4 Q dialer bundle 1
9 e% w4 M) m2 a  ?5 X! a; r  S; j dialer-group 1- i& t$ s  h/ N: ^& P. y
nat outbound 2000
* F* s+ E2 f/ l$ j+ q$ E: m#
/ k* U8 i6 F6 y# Breturn
( r8 S# W7 l( a0 |- r0 l2 e( B$ g[pppoe-client-Dialer1]
$ K& m3 t$ v' i8 B% F$ D0 ^
9 V' Z$ T, K$ n9 H0 F- w" k, T接下来我们就可以ping通10.1.12.2 了。6 j5 x0 w2 f! v% q" h
$ K& C% A$ t4 z& U6 e: ~( U3 D
PC2>ping 10.1.12.21 G# j5 m, l  k" ?: b

" K; p0 O+ f* v: M% f, ^Ping 10.1.12.2: 32 data bytes, Press Ctrl_C to break
7 k( t0 c8 L* h+ O; wFrom 10.1.12.2: bytes=32 seq=1 ttl=254 time=31 ms+ _0 Z3 z: e/ _0 _7 [
From 10.1.12.2: bytes=32 seq=2 ttl=254 time=32 ms8 w/ X" Q3 W: k; R
From 10.1.12.2: bytes=32 seq=3 ttl=254 time=46 ms# v: v6 c: S/ C: e
From 10.1.12.2: bytes=32 seq=4 ttl=254 time=32 ms
' t' P; d2 k  p3 yFrom 10.1.12.2: bytes=32 seq=5 ttl=254 time=31 ms5 J8 ^! S0 ?9 }9 q! c+ y
$ E! ]5 N# Z5 V/ D# r6 D% A2 I0 Z
--- 10.1.12.2 ping statistics ---
" ^, l; Q( a$ @& i  5 packet(s) transmitted
" W+ Y; e8 L& A0 e  5 packet(s) received' R; m+ f1 [2 l  K4 O$ t
  0.00% packet loss1 a* o, l/ \  n# W6 }+ ?6 i
  round-trip min/avg/max = 31/34/46 ms) ~! X8 X2 e- x: K: q

" E$ r; ^" y, i$ [0 ?% h8 Y- j/ I
6 ^# c9 n5 z/ {! _; z9 H# O

1

主题

0

回帖

12

积分

管理员

积分
12
QQ
 楼主| 发表于 2022-3-17 09:27:15 | 显示全部楼层
华为路由器:PPPoE实验; C/ u0 \. ~0 c8 u7 R
PPPoE协议是基于C/S架构的一种网络拨号协议。分为客户端和服务器两部分,它的建立过程分为discovery和session两个阶段。本次实验的目标:掌握PPPoE拨号技术;1 y0 d# K( \0 U
实验拓扑:& @! z  d* d7 C3 _6 e7 J

, X+ P" r8 k' Q% |8 n# s  y/ b本实验结合虚拟机进行:5 |- J& w& l4 t
首先,必须在虚拟机的网络配置中加以设置,我新建了VM6,去掉了DHCP的钩。这个时候会在你的网卡界面多出来一个虚拟的VM6的网卡。但是当你打开ensp时,会出现检测不到VM6的情况,这个时候你重启一下电脑,就可以了。
! p3 J: @- s. W% S, H! X4 r. K4 B+ n$ }- n9 y
Cloud1的设置如下图:
6 m/ p# h  F% O; V. t
- ^+ Y5 N2 V; B& k1、基本的IP配置- k/ a9 u/ _& \$ ]4 j7 b  I8 o- N
[pppoe-server]dis ip in b
+ K$ |$ Q; t1 R' e' m5 c) q*down: administratively down
: s# [: }$ ?) B* @9 I$ Q% d' C^down: standby
) f0 V- A8 A$ t0 i3 H$ {2 r(l): loopback
- z$ x& O3 M  Q4 a8 i(s): spoofing
/ x7 P- P/ u/ L$ MThe number of interface that is UP in Physical is 4
8 k0 P- z% r  v& b/ P: FThe number of interface that is DOWN in Physical is 1
$ c$ \7 I5 I4 {/ y; IThe number of interface that is UP in Protocol is 2, @5 U9 b  I! T* s. k
The number of interface that is DOWN in Protocol is 3
$ l. ]5 m9 b% F4 T4 L) C' SInterface                         IP Address/Mask      Physical   Protocol  
1 d$ U5 K* S6 \3 k4 RGigabitEthernet0/0/0              unassigned           up         down      
; |8 P5 J" P( U" |# rGigabitEthernet0/0/1              202.104.10.1/24      up         up        
: q1 N6 V2 k- ]. fGigabitEthernet0/0/2              unassigned           down       down      
0 \7 @% g6 j+ r7 k% s. F9 fNULL0                             unassigned           up         up(s)     
- m8 h  Y2 k: KVirtual-Template1                 192.168.10.1/24      up         down      8 ~$ W. W; C0 j/ y: c
[pppoe-server]6 C- x  A$ F) r

. u$ f8 Q3 y: g) f8 S0 w2、配置虚拟模板; A# u9 f$ I6 F- j, n% A
配置虚拟模板用来承载多种同层协议) `4 Z9 j( b9 g
[pppoe-server]int Virtual-Template 1                            #创建虚拟模板,编号为1
, q8 i# C0 {( O) d7 v% g0 k[pppoe-server-Virtual-Template1]ppp authentication-mode chap    #PPP认证为chap% z: m3 {2 L& M/ V4 ?/ J
[pppoe-server-Virtual-Template1]remote address pool pokes       #指定使用地址池名为pokes# w) b& k0 G$ H. @8 D; i
[pppoe-server-Virtual-Template1]ip add 192.168.10.1 24          #配置作为用户上网的网关IP, e7 h- q4 @4 j" `: P& Y$ `5 s
[pppoe-server-Virtual-Template1]q
' h- p2 F' @- Y6 o5 L! o' C0 `# P8 m* U1 \: ^; p: u
3、创建地址池6 f* r- U9 _, ?5 O2 f9 y
[pppoe-server]ip pool pokes                                            #创建地址池pokes" b8 Z9 I2 \/ ~% O
Info: It's successful to create an IP address pool.- \- m9 \' q' @4 V+ F
[pppoe-server-ip-pool-pokes]gateway-list 192.168.10.1                  #配置网关地址5 k% f9 l/ z$ ?: t. R, z$ u) n0 H
[pppoe-server-ip-pool-pokes]network 192.168.10.0 mask 255.255.255.0    #配置给用户分配的ip网段
$ A9 S- E" u$ y6 @& A( y9 L[pppoe-server-ip-pool-pokes]4 N7 h: H1 W" a7 T& o4 `
[pppoe-server-ip-pool-pokes]excluded-ip-address 192.168.10.200 192.168.10.254    #排除地址* E! h- q, L7 Z! s
[pppoe-server-ip-pool-pokes]lease day 8 hour 0 minute 0     #租约配置8小时
: W  v4 h$ L4 l2 W  E. M$ B[pppoe-server-ip-pool-pokes]dns-list 114.114.114.114        #DNS* g+ ?8 f  n8 f! m6 b
[pppoe-server-ip-pool-pokes]dis th0 u0 v2 Q' y( b  A
[V200R003C00]
  ]4 d8 D( \, e7 u7 h: G$ n#
( k) F. w  k9 j: q7 o3 _' |ip pool pokes. _! k3 [: P4 ^4 C# \  k
gateway-list 192.168.10.1
1 ~5 @, H9 t8 W2 e3 o" f+ k! d network 192.168.10.0 mask 255.255.255.0   d6 r, U6 v# a
excluded-ip-address 192.168.10.200 192.168.10.254
% h3 T! U' L6 h. h lease day 8 hour 0 minute 0
: ?9 G) U! ^4 m; j! L$ w8 p9 a dns-list 114.114.114.114
6 `2 B7 ^1 v8 T1 M; x#4 v, c% u. o! I
return
5 s- v! b7 a+ I4 \/ ~4 ~, L, {[pppoe-server-ip-pool-pokes], ~) u! R2 ~: b- ^0 j: ]* U/ J, O

+ a9 x" r. g( ^3 y4、创建PPPoE用户
$ X7 w9 |4 ]/ ?1 D[pppoe-server]aaa. K2 f: a# S; p0 ~+ N" ~
[pppoe-server-aaa]local-user user1 password cipher 123456
9 e& a$ w6 Y9 f8 Y8 HInfo: Add a new user.
8 x  g! G( x0 O1 i. J[pppoe-server-aaa]local-user user1 service-type ppp
0 E% H/ {7 W7 X0 d  g[pppoe-server-aaa]dis th, U: P( K9 _+ L- h1 D. `
[V200R003C00]$ o- E' O  h: @* L2 d
## f- O) }/ I4 Z! n2 I9 ]
aaa
( P" n) C' l5 s6 R, P authentication-scheme default8 R* k# U) v9 x4 G0 r; c7 n9 X2 I" T
authorization-scheme default
( O/ z& l! }& }- z accounting-scheme default6 T0 N/ _8 B$ l! U  E' V$ m
domain default
- z+ f0 T3 L& `- w) s, }1 L' t domain default_admin
' d" F& s* i' l4 b7 \* G local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$4 ?6 e  w" \" e8 q( e
local-user admin service-type http
, V' m6 W' `- d6 O% |9 W6 [: Q" M local-user user1 password cipher %$%$aLq+.xS\rBJXJ}V|dJw'eZry%$%$
9 F1 u) M# d3 Y4 D local-user user1 service-type ppp8 I' F' s3 E8 T9 G! [9 m
#) O, q; O1 \3 U
return
9 v% A6 ]3 D! C/ Z! h* E- I* H8 F[pppoe-server-aaa]
2 G7 U9 O# l, T0 w" v4 a) d0 ?% w; p" \; k  i, ?6 p; B4 M
5、绑定接口
( Q+ w0 [0 \6 S7 w& I0 L4 {2 S$ Q将虚拟模板接口与物理接口绑定提供服务
, @9 g+ G) W7 g[pppoe-server]int g0/0/0; m& F5 e! f! ]* a6 z# j% _: \* f
[pppoe-server-GigabitEthernet0/0/0]pppoe-server bind virtual-template 1  #将虚拟模板1绑定在物理接口上; I* @/ H7 p( x, Z1 Z
. q# ^0 Q6 A8 \; P  R5 c
至此,服务器端的配置基本完成,如果想对PPPoE的访问流量进行控制,还可以配置ACL。
9 J/ x6 q/ _: _5 ]/ Y8 P4 }
: r2 s$ R; |& n; q* R- s
9 e4 p+ _  F2 J8 h  E" w虽然已经拨号成功,也能ping通网关192.168.10.1,但是因为没有nat所以无法ping通202.104.10.150的服务器, Q( q$ M+ b6 j1 d) d' s8 U5 Y; A
6、NAT配置
/ O) I  D8 R( o  c% L2 X9 t[pppoe-server]acl number 20002 G3 r. V& w8 o
[pppoe-server-acl-basic-2000]rule permit source 192.168.10.0 0.0.0.255( y; |) f; m- q1 k: s
[pppoe-server-acl-basic-2000]int g0/0/1$ h" m+ j1 q. @# W. ^
[pppoe-server-GigabitEthernet0/0/1]nat outbound 2000( N* R. d/ H+ J1 @7 {/ A# ?* W
[pppoe-server-GigabitEthernet0/0/1]q! _, p) r3 `7 B! a, W# x  p. _

$ N$ e1 X, N4 }7 N% x+ T% p说明:这里ACL的含义就是允许哪些网段可以上网,这里为192.168.10.0/24这个网段,然后调用在拨号接口下。
* O0 ~4 t# }# }( m+ `0 F现在就可以ping通服务器了
1 ]; H( ]- s, k+ [
2 m6 u% r# _7 _' O1 W# Z5 F
您需要登录后才可以回帖 登录 | 注册

本版积分规则

返回首页|Archiver|手机版|小黑屋|易陆发现技术论坛 ( 蜀ICP备2026014127号-1 )

GMT+8, 2026-6-12 03:02 , Processed in 0.024537 second(s), 23 queries .

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表