一、實驗要求
掌握PPP的基本配置
掌握PPP PAP的配置
掌握PPP CHAP的配置
熟悉使用MP-Group配置PPP MP
二、實驗描述及組網圖
廣域網協議需要適應多變的網絡類型，HDLC只支持同步串行鏈路，并且不支持驗證。而PPP支持同異步線路，能夠提供驗證，易于擴展。
(圖1)
實驗組網如圖所示，圖1使用兩臺MSR系列路由器（JIANCE1，JIANCE2）
三、實驗過程
實驗任務一：PPP協議基本配置
步驟一：搭建實驗環境及基本配置
按照圖1搭建好實驗環境，并給兩臺路由器接口配置好IP 地址
步驟二：給jiance1上S1/0接口封裝PPP協議并查看相應接口信息
jiance1：
[jiance1]interface Serial 1/0
[jiance1-Serial1/0]link-protocol ppp
[jiance1-Serial1/0]ip address 10.2.1.2 24
通過display interface命令查看接口信息
[jiance1]display interface Serial 1/0
Serial1/0 current state :UP——物理接口UP
Line protocol current state :UP——PPP協議UP
Description : Serial1/0 Interface
The Maximum Transmit Unit is 1500, Hold timer is 1(sec)
Internet Address is 10.2.1.1/24
Link layer protocol is PPP——鏈路類型為PPP
LCP opened, IPCP opened, OSICP opened——LCP和IPCP狀態為opened
Output queue : (Urgent queuing : Size/Length/Displaycards) 0/51/0
Output queue : (Protocol queuing : Size/Length/Displaycards) 0/501/0
Output queue : (FIFO queuing : Size/Length/Displaycards) 0/75/0
Physical layer is synchronous,
Interface is DTE, Cable type is V24
Last clearing of counters: Never
Last 300 seconds input rate 14.02 bytes/sec, 112 bits/sec, 0.85 packets/sec
Last 300 seconds output rate 21.83 bytes/sec, 174 bits/sec, 1.21 packets/sec
Input: 414 packets, 7706 bytes
0 broadcasts, 0 multicasts
0 errors, 0 runts, 0 giants
0 CRC, 0 align errors, 0 overruns
0 dribbles, 0 aborts, 0 no buffers
0 frame errors
Output:623 packets, 13616 bytes
0 errors, 0 underruns, 0 collisions
0 deferred
DCD=UP DTR=UP DSR=UP RTS=UP CTS=UP
步驟三：給jiance2上S1/0接口封裝PPP協議并查看相應接口信息
jiance2：
[jiance2]interface Serial 1/0
[jiance2-Serial1/0]link-protocol ppp
[jiance2-Serial1/0]ip address 10.2.1.2 24
通過display interface命令查看接口信息
[jiance2]display interface Serial 1/0
Serial1/0 current state :UP
Line protocol current state :UP
Description : Serial1/0 Interface
The Maximum Transmit Unit is 1500, Hold timer is 1(sec)
Internet Address is 10.2.1.2/24
Link layer protocol is PPP
LCP opened, IPCP opened
Output queue : (Urgent queuing : Size/Length/Displaycards) 0/51/0
Output queue : (Protocol queuing : Size/Length/Displaycards) 0/501/0
Output queue : (FIFO queuing : Size/Length/Displaycards) 0/75/0
Physical layer is synchronous,Baudrate is 64000 bps
Interface is DCE, Cable type is V24
Last clearing of counters: Never
Last 300 seconds input rate 21.63 bytes/sec, 173 bits/sec, 1.13 packets/sec
Last 300 seconds output rate 12.85 bytes/sec, 102 bits/sec, 0.74 packets/sec
Input: 814 packets, 15882 bytes
3 broadcasts, 0 multicasts
0 errors, 0 runts, 0 giants
0 CRC, 0 align errors, 0 overruns
0 dribbles, 0 aborts, 0 no buffers
0 frame errors
Output:618 packets, 10234 bytes
0 errors, 0 underruns, 0 collisions
0 deferred
DCD=UP DTR=UP DSR=UP RTS=UP CTS=UP
步驟四：檢查兩臺jiance1與jiance2的連通性
在jiance1上ping jiance2的接口地址，顯示如下：
jiance1:
[jiance1]ping 10.2.1.2
PING 10.2.1.2: 56 data bytes, press CTRL_C to break
Reply from 10.2.1.2: bytes=56 Sequence=1 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=2 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=3 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=4 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=5 ttl=255 time=27 ms
--- 10.2.1.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 27/27/27 ms
實驗任務二：PPP PAP認證配置
實驗要求jiance1和jiance2之間采用PAP驗證, jiance1作為主驗證方
步驟一：在jiance1上配置本地以PAP方式認證對端路由器jiance2
在jiance1上創建本地用戶名和密碼
[jiance1]local-user jiance1
[jiance1-luser-JIANCE2]password simple jiance
[jiance1-luser-JIANCE2]service-type ppp
在jiance1上配置本地驗證的方式為PAP
[jiance1]interface Serial 1/0
[jiance1-Serial1/0]ppp authentication-mode pap
步驟二:在jiance2上配置PAP驗證時發送的用戶名和密碼
在jiance2上配置被對端驗證的密碼和用戶名（這里注意先配置密碼和對端的密碼不一致，注意看是否能ping通對端主機）
[jiance2]interface Serial 1/0
[jiance2-Serial1/0]ppp pap local-user jiance1 password simple 111 ——密碼和jiance1上的本地用戶密碼不一致
在jiance1上ping jiance2看兩臺路由器是否連通
[jiance1]ping 10.2.1.2
PING 10.2.1.2: 56 data bytes, press CTRL_C to break
Reply from 10.2.1.2: bytes=56 Sequence=1 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=2 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=3 ttl=255 time=28 ms
Reply from 10.2.1.2: bytes=56 Sequence=4 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=5 ttl=255 time=27 ms
--- 10.2.1.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 27/27/28 ms
結果顯示兩臺路由器之間能相互ping通。思考下：兩端配置的密碼不一致為什么還能ping通？
這是因為兩臺路由器的接口都已經UP，已經處于PPP會話流程的Network階段，這時它們如果要進入認證階段就要先把鏈路DOWN掉后在UP。
把jiance1上S1/0接口DOWN掉再UP
[jiance1]interface Serial 1/0
[jiance1-Serial1/0]shutdown
[jiance1-Serial1/0]undo shutdown
[jiance1-Serial1/0]
%Apr 1 19:45:55:822 2010 JIANCE1 PHY/2/PHY: Serial1/0: change status to up
%Apr 1 19:46:01:831 2010 JIANCE1 IFNET/5/UPDOWN:Line protocol on the interface Serial1/0 is UP
%Apr 1 19:46:01:897 2010 JIANCE1 IFNET/5/UPDOWN:Line protocol on the interface Serial1/0 is DOWN
%Apr 1 19:46:31:911 2010 JIANCE1 IFNET/5/UPDOWN:Line protocol on the interface Serial1/0 is UP
%Apr 1 19:46:31:978 2010 JIANCE1 IFNET/5/UPDOWN:Line protocol on the interface Serial1/0 is DOWN
%Apr 1 19:47:01:991 2010 JIANCE1 IFNET/5/UPDOWN:Line protocol on the interface Serial1/0 is UP
%Apr 1 19:47:02:057 2010 JIANCE1 IFNET/5/UPDOWN:Line protocol on the interface Serial1/0 is DOWN
結果顯示鏈路先UP 再DOWN,然后變到UP，又DOWN，間隔的時間為30s，表明鏈路的pap驗證失敗，而且在30s后還會再次驗證。
把jiance2上配置被對端驗證的密碼改為和JIANCE1上的一致
[jiance2-Serial1/0]undo ppp pap local-user
[jiance2-Serial1/0]ppp pap local-user JIANCE1 password simple jiance
[jiance2-Serial1/0]
%Apr 1 19:46:44:783 2010 JIANCE2 IFNET/5/UPDOWN:Line protocol on the interface Serial1/0 is UP
%Apr 1 19:46:44:820 2010 JIANCE2 IFNET/5/UPDOWN:PPP IPCP protocol on the interface Serial1/0 is UP
在jiance1上ping jiance2結果是可以ping通的。
[jiance1]ping 10.2.1.2
PING 10.2.1.2: 56 data bytes, press CTRL_C to break
Reply from 10.2.1.2: bytes=56 Sequence=1 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=2 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=3 ttl=255 time=28 ms
Reply from 10.2.1.2: bytes=56 Sequence=4 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=5 ttl=255 time=27 ms
--- 10.2.1.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 27/27/28 ms
實驗任務三：PPP CHAP認證配置
實驗開始前注意將PAP驗證清除。本實驗要求兩臺路由器PPP采用CHAP驗證,其中
jiance1和jiance2既為主驗證方又為被驗證方
步驟一：在jiance1上配置本地用戶名和密碼驗證方式CHAP，jiance1作為主驗證方
[jiance1]local-user jiance1
[jiance1-luser- jiance1]password simple jiance
[jiance1-luser- jiance1]service-type ppp
[jiance1-luser- jiance1]quit
[jiance1]interface Serial 1/0
[jiance1-Serial1/0]ppp authentication-mode chap
[jiance1-Serial1/0]ppp chap user jiance2
步驟二：jiance2作為被驗證方配置
使用本地用戶名及密碼進行驗證
[jiance2]local-user jiance2
[jiance2-luser- jiance2]password simple jiance
[jiance2-luser- jiance2]service-type ppp
[jiance2-luser- jiance2]quit
[jiance2]interface Serial 1/0
[jiance2-Serial1/0]ppp chap user jiance1
[jiance2-Serial1/0]shutdown
[jiance2-Serial1/0]undo shutdown
步驟三：檢查連通性
在jiance1上ping jiance2
[jiance1]ping 10.2.1.2
PING 10.2.1.2: 56 data bytes, press CTRL_C to break
Reply from 10.2.1.2: bytes=56 Sequence=1 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=2 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=3 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=4 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=5 ttl=255 time=27 ms
--- 10.2.1.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 27/27/27 ms
下面以jiance2作為主驗證方，jiance1作為被驗證方進行PPP驗證配置
步驟四：在jiance2上配置本地用戶名和密碼，驗證方式CHAP
[jiance2]local-user jiance
[jiance2-luser-jiance]password simple jiance
[jiance2-luser-jiance]service-type ppp
[jiance2-luser-jiance]quit
[jiance2]interface Serial 1/0
[jiance2-Serial1/0]ppp authentication-mode chap
步驟五：jiance1作為被驗證方配置
實驗默認CHAP密碼進行驗證
[jiance1]interface Serial 1/0
[jiance1-Serial1/0]ppp chap user jiance
[jiance1-Serial1/0]ppp chap password simple 222
結果發現不能通過驗證，現象同實驗任務二PAP驗證時密碼配錯一樣
更改jiance1接口S1/0上chap驗證密碼
[jiance1-Serial1/0]ppp chap password simple jiance
步驟六：測試jiance1和jiance2的連通性
在jiance1上把S1/0接口DOWN掉再UP，然后測試連通性
[jiance1]ping 10.2.1.2
PING 10.2.1.2: 56 data bytes, press CTRL_C to break
Reply from 10.2.1.2: bytes=56 Sequence=1 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=2 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=3 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=4 ttl=255 time=27 ms
Reply from 10.2.1.2: bytes=56 Sequence=5 ttl=255 time=28 ms
--- 10.2.1.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 27/27/28 ms
結果顯示能ping通，從步驟五和步驟七可以看出PPP是支持雙向驗證的。
如果您對技術帖內容有任何疑問，請聯系官方郵箱：jcit@jiancenj.com，也歡迎廣大學員踴躍投稿，一經錄用，有稿費酬謝。
