MGRE综合实验

一.实验拓扑

要求说明

1.R5为ISP，只能进行IP地址配置，其所有地址均配为公有IP地址

2. R1和R5间使用PPP的PAP认证，R5为主认证方；

R2与R5之间使用ppp的CHAP认证，R5为主认证方；

R3与R5之间使用HDLC封装；

3.R1，R2和R3之间创建一个MGRE的环境，R1为中心站点，R1.R4间为点到点的GRE；

4.整个私有网络基于RIP全网可达

5.所有PC设置为私网地址，可以访问R5的环回

二.配置思路

1.配置数据链路层

2.配置IP地址

3.配置数据链路层的认证

4.配置RIP和缺省路由使全网可达

5.配置MGRE与GRE

6.配置NAPT

三.实验操作步骤

1.配置数据链路层

在各接口上选择封装协议

<Huawei>sys

Enter system view, return user view with Ctrl+Z.

[Huawei]sys hub

[hub]int ser

[hub]int Serial 4/0/0

[hub-Serial4/0/0]dis this

[V200R003C00]

#

interface Serial4/0/0

link-protocol ppp

#

return

可以看到huawei设备使用Serial接口时默认为PPP协议，我们无需手动更改。

但是R3与R5之间使用了HDLC协议，所以需要在这条链路两端接口更改

选择封装协议

#在ISP设备对应接口选择封装数据链楼层协议

[Huawei]sys ISP

[ISP]int se 4/0/0

[ISP-Serial4/0/0]link-protocol hdlc //更改数据链路层协议

Warning: The encapsulation protocol of the link will be changed. Continue? [Y/N] :y//确认更改

#R3设备同理

[Huawei]sys AR3-spoke

[AR3-spoke]int ser 4/0/0

[AR3-spoke-Serial4/0/0]link-protocol hdlc

Warning: The encapsulation protocol of the link will be changed. Continue? [Y/N] :y

2.配置IP地址

#配置主机IP地址

#配置各个接口的IP地址

#R1配置

[hub]int gi 0/0/0

[hub-GigabitEthernet0/0/0]ip ad 192.168.1.254 24

[hub-GigabitEthernet0/0/0]int ser 4/0/0

[hub-Serial4/0/0]ip ad 15.1.1.1 24

#R2配置

[R2-spoke]int gi 0/0/0

[R2-spoke-GigabitEthernet0/0/0]ip ad 192.168.2.254 24

[R2-spoke-GigabitEthernet0/0/0]int ser 4/0/0

[R2-spoke-Serial4/0/0]ip ad 25.1.1.1 24

#R3配置

[AR3-spoke]int gi 0/0/0

[AR3-spoke-GigabitEthernet0/0/0]ip ad 192.168.3.254 24

[AR3-spoke-GigabitEthernet0/0/0]int se 4/0/0

[AR3-spoke-Serial4/0/0]ip ad 35.1.1.1 24

#R4配置

[R4]int gi 0/0/1

[R4-GigabitEthernet0/0/1]ip ad 192.168.4.254 24

[R4-GigabitEthernet0/0/1]int gi 0/0/0

[R4-GigabitEthernet0/0/0]ip ad 45.1.1.1 24

#R5配置

[ISP]int gi 0/0/0

[ISP-GigabitEthernet0/0/0]ip ad 45.1.1.2 24

[ISP-GigabitEthernet0/0/0]int se 3/0/0

[ISP-Serial3/0/0]ip ad 15.1.1.2 24

[ISP-Serial3/0/0]int se 3/0/1

[ISP-Serial3/0/1]ip ad 25.1.1.2 24

[ISP-Serial3/0/1]int se 4/0/0

[ISP-Serial4/0/0]ip ad 35.1.1.2 24

[ISP-LoopBack0]ip ad 5.5.5.5 24

检查配置

3.配置数据链路层的认证

R1和R5间使用PPP的PAP认证，Rs为主认证方

#配置主认证端

[ISP]aaa

[ISP-aaa]local-user R1R5 password cipher 123456 privilege level 15 //创建用户

Info: Add a new user.

[ISP-aaa]local-user R1R5 service-type ppp //为用户选择服务类型

[ISP]int ser 3/0/0

[ISP-Serial3/0/0]ppp authentication-mode pap //在接口选择认证方式

#配置被认证端

[hub-Serial4/0/0]ppp pap local-user R1R5 password cipher 123456 //认证方式，用户和密码

R2与R5之间使用ppp的CHAP认证，R5为主认证方

#配置主认证端

[ISP-aaa]local-user R2R5 password cipher 123456 privilege level 15

Info: Add a new user.

[ISP-aaa]local-user R2R5 service-type ppp

[ISP]int se 3/0/1

[ISP-Serial3/0/1]ppp authentication-mode chap

#配置被认证端

[R2-spoke-Serial4/0/0]ppp chap user R2R5

[R2-spoke-Serial4/0/0]ppp chap password cipher 123456

注意：需要重启接口才能重新开始认证

[hub-Serial4/0/0]shutdown

[hub-Serial4/0/0]undo shutdown

观察日志可以看出PPP会话建立成功了，说明认证通过了

同理

4.配置RIP和缺省路由使全网可达

#R1配置

[hub]rip 1

[hub-rip-1]version 2

[hub-rip-1]net

[hub-rip-1]network 192.168.1.0

[hub-rip-1]q

[hub]ip route-static 0.0.0.0 0 Serial 4/0/0

[hub]undo summary

#R2配置

[R2-spoke]rip 1

[R2-spoke-rip-1]version 2

[R2-spoke-rip-1]network 192.168.2.0

[R2-spoke-rip-1]q

[R2-spoke]ip route-static 0.0.0.0 0 ser 4/0/0

[R2-spoke]undo summary

#R3配置

[AR3-spoke]rip 1

[AR3-spoke-rip-1]version 2

[AR3-spoke-rip-1]network 192.168.3.0

[AR3-spoke-rip-1]q

[AR3-spoke]ip route-static 0.0.0.0 0 ser 4/0/0

[AR3-spoke]undo summary

#R4配置

[R4]rip 1

[R4]undo summary

[R4-rip-1]version 2

[R4-rip-1]net

[R4-rip-1]network 192.168.4.0

[R4-rip-1]q

[R4]ip route-static 0.0.0.0 0 45.1.1.2 //注意因为缺省路由出口是一个以太网网络，需要明确的下一跳地址

为什么此时不能填出接口，必须指定下一跳？

我们只设置出接口，抓包看实验现象

尝试ping 25.1.1.2

这是因为路由器在进行转发时，路由转发模块会根据目标IP进行查表，并将下一跳告诉出接口，再由出接口封装报文，此时出接口知道目标源目IP地址和本地mac地址，不知道目标Mac地址。所以要根据下一跳通过ARP请求获取MAC地址，这样接口才能封装一个帧。但是此时没有下一跳，我们可以观察路由表

可以看到，不写下一跳，下一条默认为本机地址。这相当于一个直连路由，所以出接口会将目标IP地址作为ARP请求对象，但是很可惜他们并不是直连的，所以没有人会回应他，自然也没办法ping通了。

指定明确下一跳继续实验观察实验现象

可以ping通，实验继续

5.配置MGRE与GRE

R1，R2和R3之间创建一个MGRE的环境，R1为中心站点

#hub配置

[hub]int Tunnel 0/0/0

[hub-Tunnel0/0/0]ip ad 10.1.2.1 24

[hub-Tunnel0/0/0]tunnel-protocol gre p2mp

[hub-Tunnel0/0/0]source 15.1.1.1

[hub-Tunnel0/0/0]nhrp network-id 1

[hub-Tunnel0/0/0]nhrp entry multicast dynamic //配置nhrp组播成员表

[hub]rip 1

[hub-rip-1]network 10.0.0.0

[[hub-Tunnel0/0/0]undo rip split-horizon //关闭rip的水平分割

#spoke配置

#R2

[R2-spoke-Tunnel0/0/0]ip ad 10.1.2.2 24

[R2-spoke-Tunnel0/0/0]tunnel-protocol gre p2mp

[R2-spoke-Tunnel0/0/0]source 25.1.1.2

[R2-spoke-Tunnel0/0/0]nhrp network-id 1

[R2-spoke-Tunnel0/0/0]nhrp entry 10.1.2.1 15.1.1.1 register //找中心站点注册

[R2-spoke]rip 1

[R2-spoke-rip-1]ne

[R2-spoke-rip-1]network 10.0.0.0

#R3

[AR3-spoke]int Tunnel 0/0/0

[AR3-spoke-Tunnel0/0/0]ip ad 10.1.2.3 24

[AR3-spoke-Tunnel0/0/0]tunnel-protocol gre p2mp

[AR3-spoke-Tunnel0/0/0]source 35.1.1.2

AR3-spoke-Tunnel0/0/0]nhrp network-id 1

[AR3-spoke-Tunnel0/0/0]nhrp entry 10.1.2.1 15.1.1.1 register

AR3-spoke]rip 1

[AR3-spoke-rip-1]net

[AR3-spoke-rip-1]network 10.0.0.0

R1.R4间为点到点的GRE

#R1

[hub-Tunnel0/0/1]ip address 10.1.1.1 255.255.255.0

[hub-Tunnel0/0/1] undo rip split-horizon

[hub-Tunnel0/0/1] tunnel-protocol gre

[hub-Tunnel0/0/1] source 15.1.1.1

[hub-Tunnel0/0/1] destination 45.1.1.1

#R4

[R4-Tunnel0/0/0]ip address 10.1.1.2 255.255.255.0

[R4-Tunnel0/0/0] undo rip split-horizon

[R4-Tunnel0/0/0] tunnel-protocol gre

[R4-Tunnel0/0/0] source 45.1.1.1

[R4-Tunnel0/0/0] destination 15.1.1.1

[R4-rip-1]network 10.0.0.0

6.配置NAT

在各个边界设备通往公网的接口上配置NAPT使PC能访问R5的环回

#R1

[hub]acl 2000

hub-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255

[hub-Serial4/0/0]nat outbound 2000

#R2

[R2-spoke]acl 2000

[R2-spoke-acl-basic-2000]rule permit source 192.168.2.0 0.0.0.255

[R2-spoke-Serial4/0/0]nat outbound 2000

#R3

[AR3-spoke]acl 2000

[AR3-spoke-acl-basic-2000]rule permit source 192.168.3.0 0.0.0.255

[AR3-spoke-Serial4/0/0]nat outbound 2000

#R4

[R4]acl 2000

[R4-acl-basic-2000]rule permit source 192.168.4.0 0.0.0.255

[R4-GigabitEthernet0/0/0]nat outbound 2000

7.验证配置

PC是否能ping通R5的环回？

PC是否能通过隧道相互访问私网？

已满足实验要求，实验结束