路由與交換技術(shù) 課件 09 PPP與PPPoE

第九章PPP與PPPoE理解PPP與PPPoE的應(yīng)用場景理解PPP的工作原理學(xué)會配置PPP，特別是PPP的Chap認(rèn)證了解PPPoE的工作原理學(xué)會配置PPPoE重難點PPP與PPPoE的應(yīng)用場景(重點)PPP的Chap認(rèn)證與IP地址協(xié)商配置(重點，難點)PPPoE的工作原理（難點）PPPoE配置（重點，難點）PPP協(xié)議應(yīng)用PPP協(xié)議是一種點到點鏈路層協(xié)議，主要用于在全雙工的同異步鏈路上進(jìn)行點到點的數(shù)據(jù)傳輸。GateISPInternetLANPPP組件名稱作用鏈路控制協(xié)議LinkControlProtocol用來建立、拆除和監(jiān)控PPP數(shù)據(jù)鏈路網(wǎng)絡(luò)層控制協(xié)議NetworkControlProtocol用于對不同的網(wǎng)絡(luò)層協(xié)議進(jìn)行連接建立和參數(shù)協(xié)商PPP鏈路建立過程DeadEstablishAuthenticateTerminateNetworkUPFAILFAILOPENEDDOWNCLOSINGSUCCESS/NONEPPP幀格式Page6LCP報文封裝格式FlagInformationControlAddressFCSFlagProtocolTypeLengthData…TypeLengthData………CodeIdentifierLengthData…LCP報文配置參數(shù)的封裝格式LCP報文Page7報文類型作用Configure-Request包含發(fā)送者試圖與對端建立連接時使用的參數(shù)列表Configure-Ack表示完全接受對端發(fā)送的Configure-Request的參數(shù)取值Configure-Nak表示對端發(fā)送的Configure-Request中的某些參數(shù)取值在本端不被認(rèn)可Configure-Reject表示對端發(fā)送的Configure-Request中的某些參數(shù)本端不能識別LCP鏈路參數(shù)協(xié)商Page8RTARTBPPP10.1.1.1/3010.1.1.2/30Configure-RequestConfigure-AckS1/0/0S1/0/0LCP鏈路參數(shù)協(xié)商Page9Configure-RequestConfigure-NakConfigure-Request(修改配置參數(shù))RTARTBPPP10.1.1.1/3010.1.1.2/30S1/0/0S1/0/0LCP鏈路參數(shù)協(xié)商Page10Configure-RequestRTARTBPPP10.1.1.1/3010.1.1.2/30Configure-RejectConfigure-Request(刪除某些參數(shù))S1/0/0S1/0/0PPP認(rèn)證模式-PAPPage11Authenticate-Request明文發(fā)送用戶名和密碼Authenticate-Ack/Authenticate-Nak認(rèn)證成功/失敗認(rèn)證方

被認(rèn)證方S1/0/0S1/0/010.1.1.1/3010.1.1.2/30PPPRTARTB檢查被認(rèn)證方發(fā)送的用戶名和密碼信息是否正確PPP認(rèn)證模式-CHAPPage12ChallengeResponseSucess/FailureS1/0/0被認(rèn)證方S1/0/010.1.1.1/3010.1.1.2/30PPP認(rèn)證方RTARTB使用Challenge加密密碼信息使用Challenge加密密碼信息，與收到的加密密碼信息做比較IPCP靜態(tài)地址協(xié)商Page13S1/0/010.1.1.1/3010.1.1.2/30Configure-Request（10.1.1.1）Configure-AckConfigure-Request（10.1.1.2）Configure-AckS1/0/0PPPRTARTBIPCP動態(tài)地址協(xié)商Page14Configure-Request（0.0.0.0）Configure-Nak（10.1.1.1）Configure-Request（10.1.1.2）Configure-AckConfigure-Request（10.1.1.1）Configure-AckS1/0/0S1/0/010.1.1.2/30PPPRTARTBPPP基本配置Page15[RTA]interfaceSerial1/0/0[RTA-Serial1/0/0]link-protocolpppWarning:Theencapsulationprotocolofthelinkwillbechanged.Continue?[Y/N]:y[RTA-Serial1/0/0]ipaddress10.1.1.130RTARTBPPP10.1.1.1/3010.1.1.2/30S1/0/0S1/0/0PAP認(rèn)證Page16S1/0/0RTARTBPPP10.1.1.1/3010.1.1.2/30[RTA]aaa[RTA-aaa]local-userhuaweipasswordcipherhuawei[RTA-aaa]local-userhuaweiservice-typeppp[RTA]interfaceSerial1/0/0[RTA-Serial1/0/0]link-protocolppp[RTA-Serial1/0/0]pppauthentication-modepap[RTA-Serial1/0/0]ipaddress10.1.1.130[RTB]interfaceSerial1/0/0[RTB-Serial1/0/0]link-protocolppp[RTB-Serial1/0/0]ppppaplocal-userhuaweipasswordcipherhuawei[RTB-Serial1/0/0]ipaddress10.1.1.230S1/0/0被認(rèn)證方認(rèn)證方配置CHAP認(rèn)證模式Page17[RTA]aaa[RTA-aaa]local-userhuaweipasswordcipherhuawei[RTA-aaa]local-userhuaweiservice-typeppp[RTA]interfaceSerial1/0/0[RTA-Serial1/0/0]link-protocolppp[RTA-Serial1/0/0]pppauthentication-modechap[RTB]interfaceSerial1/0/0[RTB-Serial1/0/0]link-protocolppp[RTB-Serial1/0/0]pppchapuserhuawei[RTB-Serial1/0/0]pppchappasswordcipherhuaweiS1/0/0RTARTBS1/0/010.1.1.1/3010.1.1.2/30PPP被認(rèn)證方認(rèn)證方PPP地址協(xié)商[User]ints1/0/0[User-Serial1/0/0]ipaddressppp-negotiate//協(xié)商獲得IP地址[ISP]ippoolpppPool//創(chuàng)建一個IP地址池//指明用于分配的IP地址范圍[ISP-ip-pool-pppPool]network10.10.10.0mask24[ISP-ip-pool-pppPool]quit[ISP]ints1/0/0[ISP-Serial1/0/0]ipaddress10.10.10.130//本端IP地址[ISP-Serial1/0/0]remoteaddresspoolpppPool//指明IP地址池S1/0/0USERISPS1/0/0PPP被認(rèn)證方認(rèn)證方PPPoE在DSL中的應(yīng)用Page19主機(jī)A主機(jī)BModemDSLAMPPPoE服務(wù)器企業(yè)網(wǎng)絡(luò)ISPPPPoE客戶端PPPoE報文Page20PPPoE報文是使用Ethernet格式來進(jìn)行封裝的。DMACType6B6B46-1500B4BPPPoEFCS2BSMACVerCode4b4b2BSessionIDLength1BTypePayLoad2BPPPoE會話建立過程Page21階段描述發(fā)現(xiàn)階段獲取對方以太網(wǎng)地址，以及確定唯一的PPPoE會話。會話階段包含兩部分：PPP協(xié)商階段和PPP報文傳輸階段。會話終結(jié)階段會話建立以后的任意時刻，發(fā)送報文結(jié)束PPPoE會話PPPoE協(xié)議報文Page22類型描述PADIPPPoE發(fā)現(xiàn)初始報文PADOPPPoE發(fā)現(xiàn)提供報文PADRPPPoE發(fā)現(xiàn)請求報文PADSPPPoE發(fā)現(xiàn)會話確認(rèn)報文PADTPPPoE發(fā)現(xiàn)終止報文PPPoE通過這五種類型的報文來建立和終結(jié)PPPoE會話。PPPoE發(fā)現(xiàn)階段Page23PADIPADIPADIPADISWA客戶端通過廣播發(fā)送PADI報文來發(fā)現(xiàn)接入服務(wù)器。服務(wù)器A服務(wù)器B服務(wù)器CRTAPPPoE發(fā)現(xiàn)階段Page24PADO-BPADO-BPADO-ASWA所有的PPPoE服務(wù)器在收到PADI報文之后，將客戶端請求的服務(wù)與自己能夠提供的服務(wù)進(jìn)行比較，如果可以提供，則單播回復(fù)PADO報文。RTAPADO-A服務(wù)器A服務(wù)器B服務(wù)器CPPPoE發(fā)現(xiàn)階段Page25PADRPADRSWAPPPoE客戶端選擇最先收到的PADO報文對應(yīng)的PPPoE服務(wù)器，并單播發(fā)送一個PADR報文。RTA服務(wù)器A服務(wù)器B服務(wù)器CPPPoE發(fā)現(xiàn)階段Page26PADSPADSSWAPPPoE服務(wù)器生成唯一的PPPoESessionID，并發(fā)送PADS報文給客戶端，會話建立成功。RTA服務(wù)器A服務(wù)器B服務(wù)器CPPPoE會話階段Page27PPPoE會話上的PPP協(xié)商和普通的PPP協(xié)商方式一致，分為LCP、認(rèn)證、NCP三個階段。PPPoE會話的PPP協(xié)商成功后，就可以傳輸PPP數(shù)據(jù)。PPP參數(shù)協(xié)商PPP參數(shù)協(xié)商SWARTA服務(wù)器A服務(wù)器B服務(wù)器CPPPoE會話終結(jié)Page28PADTPADTSWARTAPADT報文用于通知對端PPPoE會話結(jié)束。服務(wù)器A服務(wù)器B服務(wù)器CPPPoE會話建立過程Page29服務(wù)器ALCPNegotiationChallengeResponseSuccess/FailureNCPNegotiationPADOPADRPADSPADIPPPOE

協(xié)商PPP協(xié)商RTAPPPoE配置（客戶端）Page30RTA主機(jī)AISPPPPoE服務(wù)器PPPoE客戶端[RTA]dialer-rule//紅色部分僅在按需括號時需要[RTA-dialer-rule]dialer-rule1ippermit[RTA-dialer-rule]quit[RTA]interfacedialer1[RTA-Dialer1]dialeruserenterprise[RTA-Dialer1]dialer-group1[RTA-Dialer1]dialerbundle1[RTA-Dialer1]pppchapuserenterprise@Huawei//user名可隨便設(shè)置[RTA-Dialer1]pppchappasswordcipherhuawei[RTA-Dialer1]ipaddressppp-negotiatePPPoE配置（客戶端）Page31G0/0/1[RTA]interfaceGigabitEthernet0/0/1[RTA-GigabitEthernet0/0/1]pppoe-clientdial-bundle-number1on-demand[RTA-GigabitEthernet0/0/1]quit[RTA]iproute-static0.0.0.00dialer1RTA主機(jī)AISPPPPoE服務(wù)器PPPoE客戶端配置驗證Page32<RTA>displayinterfaceDialer1Dialer1currentstate:UPLineprotocolcurrentstate:UP(spoofing)Description:HUAWEI,ARSeries,Dialer1InterfaceRoutePort,TheMaximumTransmitUnitis1500,Holdtimeris10(sec)InternetAddressisnegotiated,192.168.10.254/32LinklayerprotocolisPPPLCPinitialPhysicalisDialerBoundtoDialer1:0:Dialer1:0currentstate:UPLineprotocolcurrentstate:UPLinklayerprotocolisPPPLCPopened,IPCPopened配置驗證Page33[RTA]displaypppoe-clientsessionsummaryPPPoEClientSession:IDBundleDialerIntfClient-MACServer-MACState011GE0/0/154899876830c000000000000IDLE[RTA]displaypppoe-clientsessionsummaryPPPoEClientSession:IDBundleDialerIntfClient-MACServer-MACState111GE0/0/100e0fc0308f600e0fc036781UPPPPoE配置（服務(wù)器端）Page34RTA主機(jī)AISPPPPoE服務(wù)器PPPoE客戶端[ISP]ippoolpppoePool//配置IP地址池[ISP-ip-pool-pppoePool]network10.10.10.0mask24[ISP-ip-pool-pppoePool]quit[ISP]