华为路由器：PPPOE配置模拟实验及NAT配置

admin

实验环境
7 D9 N! f  a5 e
pppoe-client上面的接口信息
8 A: z8 g* p5 y8 \
8 `. O" S4 o1 e* ?9 T+ \  l[AR1]dis ip interface brief
*down: administratively down
^down: standby
7 L0 t- y+ [' c. p& ]1 J(l): loopback
4 [" F+ S- k$ M" k. Y7 }(s): spoofing
$ F; w4 @& v- i$ X9 J% bThe number of interface that is UP in Physical is 2
The number of interface that is DOWN in Physical is 1
The number of interface that is UP in Protocol is 1
The number of interface that is DOWN in Protocol is 2

7 j9 B  J/ s+ F7 h+ V4 zInterface                         IP Address/Mask      Physical   Protocol  
" ?, K/ ?% [4 f7 Y3 n5 x! \GigabitEthernet0/0/0              unassigned           up         down      
GigabitEthernet0/0/1              192.168.1.254/24     down       down      
- X. L% }& K, h# WNULL0                             unassigned           up         up(s)     
) z1 D3 B2 d- _4 u; O
& j$ p( [/ G9 a8 O. s2 |
配置了基于接口的DHCP

$ Z* y" k/ Y: F, t5 iinterface GigabitEthernet0/0/1
& L# v+ g. r0 V& s! i ip address 192.168.1.254 255.255.255.0
dhcp select interface
, h. t% h0 l5 Z' F6 G8 r dhcp server dns-list 8.8.8.8
dhcp server domain-name pokes.com
# l4 [/ V& q4 c- x" z& f
注意事项：AR1、AR2的物理接口g0/0/0不配地址.
' G( I  ^5 Z& d0 h5 r$ u; j: }+ S2 i
# r& _( I& X7 A* ?$ q' u一、pppoe-server的配置
1、pppoe-server 配置地址池
3 R- |# X! [* c$ `* W; a[pppoe-server]ip pool pokes            #创建名为pokes的地址池，名字可以随便起，后面要调用
Info: It's successful to create an IP address pool.
[pppoe-server-ip-pool-pokes]network 10.1.12.0 mask 24   #地址池为10.1.12.0/24
[pppoe-server-ip-pool-pokes]dis th
[V200R003C00]
1 w; G) R( g0 T5 s5 l2 ~0 I#
ip pool pokes
! Q) D3 i( O* f" a* o& N network 10.1.12.0 mask 255.255.255.0
#
return
/ P% f0 |" v/ y. W* p[pppoe-server-ip-pool-pokes]q

) |3 g3 H0 J0 B2、配置虚拟口关联地址池
配置虚拟口关联地址池，即创建Virtual-Template 1模版。
/ V: o# F6 [3 P3 M' ]3 f
[pppoe-server]interface Virtual-Template 1    #创建虚拟接口1
9 s; M8 U5 x: E* o- z4 g" B[pppoe-server-Virtual-Template1]ip add 10.1.12.2 24                   #虚拟接口1的地址
: Q0 ?# T7 b( I1 B2 P" {8 X1 W[pppoe-server-Virtual-Template1]ppp authentication-mode chap   #认证类型
8 Z1 Z8 \! k. ?* u9 y1 x5 B  Z8 {[pppoe-server-Virtual-Template1]remote address pool pokes      #客户端的地址池pokes
: E' `" x$ X3 i9 O7 q5 ~[pppoe-server-Virtual-Template1]dis th
+ ~; p' X! p+ v. Yinterface Virtual-Template1
ppp authentication-mode chap
! J; K7 u( D8 o0 w$ B remote address pool pokes
ip address 10.1.12.2 255.255.255.0
" B( N; X0 c% U# B, h
% H/ \; ^) f5 C5 j4 C[pppoe-server]int g0/0/0       
' Z% A; m# Y! a1 P7 U# ?/ I[pppoe-server-GigabitEthernet0/0/0]pppoe-server bind virtual-template 1   #将虚拟接口1关联到g0/0/0接口
[pppoe-server-GigabitEthernet0/0/0]dis th
[V200R003C00]
) h. o/ P" b* k" \! k7 O" M! k0 [0 x#
interface GigabitEthernet0/0/0
1 ^) a: b! ?4 O( T1 }# S: m3 s pppoe-server bind Virtual-Template 1
) L' s0 v$ L9 p& s) l#
1 F& r, {- g# t% @return
[pppoe-server-GigabitEthernet0/0/0]

3、创建pppoe拨号的账号
按理我们应该创建pppoe拨号的账号。
- k7 o1 B0 j' A6 J1 U这里为了演示拨号失败，我们这里先不新建账号，后面再新建。

二、pppoe-client的配置
[pppoe-client]dialer-rule   
/ `1 K6 q' g2 q, \/ u[pppoe-client-dialer-rule]dialer-rule 1 ?
  acl   Permit or deny based on access-list   
& Q2 a' p: t% p5 i! J: O  Z  ip    Ip
# ]/ g$ h7 Y0 d, ^/ k  ipv6  Ipv6       
[pppoe-client-dialer-rule]dialer-rule 1 ip permit   #创建拨号规则，允许ip流量触发拨号

! w( f" L1 t- M1 f1 a[pppoe-client]interface Dialer 1
1 H2 T8 ^! @' H2 X( i0 lJul 15 2021 18:55:22-08:00 pppoe-client %%01IFPDT/4/IF_STATE(l)[0]:Interface Dia
ler1 has turned into UP state.
[pppoe-client-Dialer1]ip add       
  M$ }* F, U2 I3 W[pppoe-client-Dialer1]ip address ppp       
[pppoe-client-Dialer1]ip address ppp-negotiate  #地址采用ppp协商
% W' g! E0 {7 G& _' A4 ?: ?
[pppoe-client]interface Dialer 1                #创建接口拨号组1
[pppoe-client-Dialer1]ip address ppp-negotiate  #ip地址采用ppp协商
[pppoe-client-Dialer1]dialer user zhprny        #此用户不用于认证，是标识作用以及和dialer绑定
& Z9 G. |" }3 u) |$ [9 w0 B, Q$ y[pppoe-client-Dialer1]dialer bundle 1           #设备通过Dialer bundle将物理接口与拨号接口关联起来。
% s: N7 y0 T# t, {: W6 E/ R/ A- B[pppoe-client-Dialer1]dialer-group 1             #放到一个拨号访问组1中
8 {/ d/ V) y) v0 q: j# S% P2 @: E[pppoe-client-Dialer1]ppp chap user pokes        #指定dialer1接口的编号，拨号账号
$ I. x- Y3 k& F; a[pppoe-client-Dialer1]ppp chap password 123456   #拨号的密码


[pppoe-client-Dialer1]dis th
[V200R003C00]
#
, i* s+ d" N$ W2 p3 W" zinterface Dialer1
( b2 o  B. L; d; I link-protocol ppp
ppp chap user pokes
ppp chap password cipher %$%$I/!'WCyd<7p[~8;,>51L,$sl%$%$
% R$ Q4 H1 t4 |2 N; d) ~ ip address ppp-negotiate
* I2 |7 c! G+ F/ Y) G dialer user zhprny
dialer bundle 1
- Z: ?  r; [& F/ E# z, S dialer-group 1
9 E8 m, ^; F: T( T6 _) I
[pppoe-client-GigabitEthernet0/0/0]
Jul 15 2021 19:07:54-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[0]:The line pr
otocol PPP on the interface Dialer1:0 has entered the UP state.  #PPP已进入启动状态
% w' N/ r5 i4 @, p8 T[pppoe-client-GigabitEthernet0/0/0]
Jul 15 2021 19:07:54-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[1]:The line pr
, j+ \' ]( W7 Gotocol PPP on the interface Dialer1:0 has entered the DOWN state. #PPP已进入关闭状态

#不停的循环。。。。
' ]0 P2 p* z/ l  j9 g
/ `. P  ?2 f- y' r! M! n7 y
#原因是没有认证成功，因为我们在PPPOE-server上面还没有创建认证用户和密码

三、pppoe服务器上新建认证用户
我们到服务器上直接新建认证用户：
3 x# D4 L4 q" Q+ z9 o1 R
[pppoe-server]aaa
4 K: b- S) S7 ^; Q[pppoe-server-aaa]local-user pokes password cipher 123456
Info: Add a new user.
[pppoe-server-aaa]local-user pokes service-type ppp    #类型为ppp


四、客户端验证结果
1、认证成功信息
然后客户端就会出现认证成功的提示：

! m, @6 A1 S9 O0 Z* C& |' `* s[pppoe-client-GigabitEthernet0/0/0]
Jul 15 2021 19:09:23-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[10]:The line p
rotocol PPP on the interface Dialer1:0 has entered the UP state.
[pppoe-client-GigabitEthernet0/0/0]
Jul 15 2021 19:09:23-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[11]:The line p
! E- H' y; Z8 Z: l! _/ krotocol PPP IPCP on the interface Dialer1:0 has entered the UP state.
9 v  \% S# u! ^5 p5 h# t) O[pppoe-client-GigabitEthernet0/0/0]q
[pppoe-client]dis ip in b
! U( R1 v2 W7 ]( u9 q% q# |*down: administratively down
! K9 Z( q3 P7 j0 K5 e- y^down: standby
, T3 Y" [3 B# X) M9 X(l): loopback
(s): spoofing
  C- W6 ^* j1 y! \* x  i6 a$ X: {The number of interface that is UP in Physical is 4
; ?6 b# M0 K' aThe number of interface that is DOWN in Physical is 0
The number of interface that is UP in Protocol is 3
- W( m4 a, f# U5 T& i0 B% yThe number of interface that is DOWN in Protocol is 1

Interface                         IP Address/Mask      Physical   Protocol  
# C& @! @, T( g+ b5 xDialer1                           10.1.12.254/32       up         up(s)     #拿到了PPPOE服务器上的地址
  x/ y9 W! K4 P* b& z3 G5 p( L2 `GigabitEthernet0/0/0              unassigned           up         down      
$ f! J7 ?' I; L2 \; cGigabitEthernet0/0/1              192.168.1.254/24     up         up        
( X7 g' r' G# gNULL0                             unassigned           up         up(s)

6 ?* @1 U; k9 w- X1 l( w. k
2 n( {: L: [; ^2 U- F2、pppoe-server 信息
<pppoe-server>dis interface Virtual-Template 1
) J' f$ {+ D( PVirtual-Template1 current state : UP
4 e& ^( d; h. V! tLine protocol current state : UP
9 J) F6 D  {  k( uLast line protocol up time : 2021-07-15 19:09:22 UTC-08:00
* u9 e/ O" l, j8 R8 o: H2 N' zDescription:HUAWEI, AR Series, Virtual-Template1 Interface
Route Port,The Maximum Transmit Unit is 1492, Hold timer is 10(sec)
Internet Address is 10.1.12.2/24
6 D7 T. I! A; h! C, [' V3 fLink layer protocol is PPP
LCP initial
Physical is None
Current system time: 2021-07-15 20:27:28-08:00
5 q$ i* @* s$ h, ]    Last 300 seconds input rate 0 bits/sec, 0 packets/sec
( E6 u0 @9 M) Q) K& y1 X. P, F$ R& t! S    Last 300 seconds output rate 0 bits/sec, 0 packets/sec
' @: Y. a: g9 F" b% y8 t    Realtime 0 seconds input rate 0 bits/sec, 0 packets/sec
    Realtime 0 seconds output rate 0 bits/sec, 0 packets/sec
    Input: 0 bytes
    Output:0 bytes
( K6 w7 c" @6 W7 Z( I' }& Z- ?- u- P0 K    Input bandwidth utilization  :    0%
    Output bandwidth utilization :    0%
- P* d; k* i! J' J
<pppoe-server>


( I1 E" I7 |  _6 a" N2 u4 z8 c3、pppoe-client信息
<pppoe-client>dis interface Dialer 1
Dialer1 current state : UP
Line protocol current state : UP (spoofing)
Description:HUAWEI, AR Series, Dialer1 Interface
# D* F. \  ~0 d8 D' q& e# GRoute Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
Internet Address is negotiated, 10.1.12.254/32
Link layer protocol is PPP
LCP initial
% K6 D  I2 O# e" k8 T$ N3 ]2 PPhysical is Dialer
2 ]0 k4 {/ q8 M* F0 I  ?Current system time: 2021-07-15 20:23:56-08:00
& @& ?: N& |6 X9 |1 Y& k/ }8 H    Last 300 seconds input rate 0 bits/sec, 0 packets/sec
    Last 300 seconds output rate 0 bits/sec, 0 packets/sec
( b  `+ f9 @* l4 Q4 ]9 E" w. c    Realtime 0 seconds input rate 0 bits/sec, 0 packets/sec
    Realtime 0 seconds output rate 0 bits/sec, 0 packets/sec
    Input: 0 bytes
    Output:0 bytes
    Input bandwidth utilization  :    0%
7 c  ?$ U1 y- B" |/ W# J    Output bandwidth utilization :    0%
3 d- P* w1 p. a, Q- EBound to Dialer1:0:
Dialer1:0 current state : UP ,
6 e- R1 b9 x0 O7 JLine protocol current state : UP
) F  V( P' l9 u8 E
Link layer protocol is PPP
/ N/ M) b2 x( a3 u9 ]% l0 vLCP opened, IPCP opened
Packets statistics:
  Input packets:0,  0 bytes
  Output packets:4, 336 bytes
  FCS error packets:0
  Address error packets:0
/ O" W) h3 r/ Y6 M  Control field control error packets:0

: v3 v  h+ B( |+ n
<pppoe-client>

五、NAT的配置
' y! V  \# I( K7 x! l) Q: b4 ?用PC2直接ping 10.1.12.254是可以通的。10.1.12.254是AR1的g0/0/0口获取到的地址，其实就是我们常说的WAN口地址。

PC2>ping 10.1.12.254

6 r/ m9 J9 \& h& Y1 iPing 10.1.12.254: 32 data bytes, Press Ctrl_C to break
; @3 a) v( a- |, h6 OFrom 10.1.12.254: bytes=32 seq=1 ttl=255 time=63 ms
; Z# G3 a! U7 }) zFrom 10.1.12.254: bytes=32 seq=2 ttl=255 time=31 ms
From 10.1.12.254: bytes=32 seq=3 ttl=255 time=47 ms
From 10.1.12.254: bytes=32 seq=4 ttl=255 time=31 ms
. t( n4 Q% \) P( ^From 10.1.12.254: bytes=32 seq=5 ttl=255 time=47 ms

--- 10.1.12.254 ping statistics ---
2 a  m/ x% {8 V  5 packet(s) transmitted
  5 packet(s) received
8 `9 `" O4 b* {, [  0.00% packet loss
% J  B& w/ E. y  round-trip min/avg/max = 31/43/63 ms

2 N: X! O2 N' T9 UPC2>ping 10.1.12.2

2 V4 J" [6 l9 j# |" s2 nPing 10.1.12.2: 32 data bytes, Press Ctrl_C to break
1 h% M, _! m) P! ^* vRequest timeout!
7 G5 {/ U$ g# [0 t! K. d9 c) x6 wRequest timeout!
Request timeout!
Request timeout!
6 [8 T, m1 _3 K+ @  O/ m* BRequest timeout!
9 t7 T; j1 X* C; R2 j1 [
--- 10.1.12.2 ping statistics ---
  5 packet(s) transmitted
  0 packet(s) received
- i1 t6 P0 r  Z9 |  L* a  100.00% packet loss
#但是无法ping通10.1.12.2

( X! c! U& K) }( U# X$ j1 g
9 v" I+ e) P" w( i0 V无法ping通10.1.12.2的原因是：我们没有做NAT .接下来我们在pppoe-client上面做NAT
" d8 @( {9 W& o0 E6 M" `; i. t% `- s8 F
" }  P2 V& x9 V1 V- s* J1、这里配置规则2000
3 K& h' c& V; H. d[pppoe-client]acl number 2000       
7 ~4 t+ I* p6 T$ [! H[pppoe-client-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
9 ]/ _6 u7 r3 M
2、将规则2000绑定到接口
. j1 U* S$ p/ L6 H/ w& r) M! ~& D/ w如下接口信息，需要注意的是pppoe的接口是Dialer1，并不是GigabitEthernet0/0/0口。我们必须将规则绑定在Dialer1口，最容易犯错的就是直接绑定在g0/0/0口。

[pppoe-client]dis ip int b
3 E9 j7 C( L  I# K# K$ @*down: administratively down
^down: standby
(l): loopback
(s): spoofing
, _4 L: \) \8 b& d" tThe number of interface that is UP in Physical is 4
. H- g/ y9 [5 \; |  }The number of interface that is DOWN in Physical is 0
The number of interface that is UP in Protocol is 3
7 H9 \  {1 ]3 s, I6 M6 a; E/ JThe number of interface that is DOWN in Protocol is 1

Interface                         IP Address/Mask      Physical   Protocol  
+ S( f, j9 z$ ~Dialer1                           10.1.12.254/32       up         up(s)     
+ [" X) F( b1 G! ZGigabitEthernet0/0/0              unassigned           up         down      
GigabitEthernet0/0/1              192.168.1.254/24     up         up        
3 V+ u3 s" i( j" j& s3 vNULL0                             unassigned           up         up(s)     
[pppoe-client]
* T* F/ F6 S; y5 Q- Y1 W
[pppoe-client]int Dialer 1       
- C  `7 g/ Y! J; n# V; |[pppoe-client-Dialer1]nat outbound 2000
8 n7 T6 n2 \0 ]3 {, M: O- X  i. `[pppoe-client-Dialer1]dis th
: n  h+ P1 _. @: y[V200R003C00]
#
' H, s& Y6 f6 N+ Finterface Dialer1
link-protocol ppp
ppp chap user pokes
ppp chap password cipher %$%$I/!'WCyd<7p[~8;,>51L,$sl%$%$
' J5 T3 c' w$ N5 p  f5 ^, [ ip address ppp-negotiate
- x+ d8 m# i" }3 \5 {# f dialer user zhprny
dialer bundle 1
" W1 E% O" z. l( ~- ? dialer-group 1
nat outbound 2000
#
return
[pppoe-client-Dialer1]
  p1 {, }7 w+ o5 U6 p2 J6 ~7 W
; j# V, ]$ Q! v' t: a$ x接下来我们就可以ping通10.1.12.2 了。

7 x' {" I9 w! v# Q" I1 lPC2>ping 10.1.12.2

Ping 10.1.12.2: 32 data bytes, Press Ctrl_C to break
- Y3 T- m; i8 b* k" f8 j5 |From 10.1.12.2: bytes=32 seq=1 ttl=254 time=31 ms
From 10.1.12.2: bytes=32 seq=2 ttl=254 time=32 ms
From 10.1.12.2: bytes=32 seq=3 ttl=254 time=46 ms
From 10.1.12.2: bytes=32 seq=4 ttl=254 time=32 ms
From 10.1.12.2: bytes=32 seq=5 ttl=254 time=31 ms
) N, O  I0 ~9 N. L
8 s+ R' w$ a; k7 A0 ~4 C--- 10.1.12.2 ping statistics ---
, s  ~; {2 p. D% j( p! y1 J: P8 ?  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
( q$ ^2 C9 x9 c# y, v( X  round-trip min/avg/max = 31/34/46 ms
) z/ |4 ^3 |' \+ k* f2 F& A