华为路由器：PPPOE配置模拟实验及NAT配置

admin

实验环境

6 y' G3 e* a8 E. T- y2 G2 Fpppoe-client上面的接口信息

4 X( Q( h+ I$ X[AR1]dis ip interface brief
*down: administratively down
4 q4 P, J8 Q* m1 Y9 ?^down: standby
(l): loopback
(s): spoofing
The number of interface that is UP in Physical is 2
3 N+ V) q9 L: ^# `, V. L2 CThe number of interface that is DOWN in Physical is 1
The number of interface that is UP in Protocol is 1
The number of interface that is DOWN in Protocol is 2

Interface                         IP Address/Mask      Physical   Protocol  
GigabitEthernet0/0/0              unassigned           up         down      
GigabitEthernet0/0/1              192.168.1.254/24     down       down      
NULL0                             unassigned           up         up(s)     

; Z3 t' e8 p$ o
9 |' Z2 B0 f$ c2 h$ J配置了基于接口的DHCP

; M6 b$ m7 u; b  y4 f4 rinterface GigabitEthernet0/0/1
7 B8 s4 c8 f) }# `2 i. l ip address 192.168.1.254 255.255.255.0
5 J$ ~# ^2 L  k  w5 l0 N/ i dhcp select interface
dhcp server dns-list 8.8.8.8
' z4 \, o* H! t/ G+ w dhcp server domain-name pokes.com

- [+ H8 z! j* m+ I/ P" D1 k注意事项：AR1、AR2的物理接口g0/0/0不配地址.

一、pppoe-server的配置
1、pppoe-server 配置地址池
[pppoe-server]ip pool pokes            #创建名为pokes的地址池，名字可以随便起，后面要调用
- q# d2 h0 d" a- M: q# iInfo: It's successful to create an IP address pool.
- C- ]4 u6 ^8 I) d5 x0 H8 \" d6 J[pppoe-server-ip-pool-pokes]network 10.1.12.0 mask 24   #地址池为10.1.12.0/24
[pppoe-server-ip-pool-pokes]dis th
" D5 e+ W: f: q/ W3 O+ e! a[V200R003C00]
#
0 T3 }& I2 C8 h$ J  u) V. [- Yip pool pokes
network 10.1.12.0 mask 255.255.255.0
#
+ r% I. j# c6 N8 h6 \2 i( ?. E* \* Qreturn
& T: s2 o. v& E[pppoe-server-ip-pool-pokes]q

2、配置虚拟口关联地址池
配置虚拟口关联地址池，即创建Virtual-Template 1模版。
% s( }2 n4 G' e, I! @
[pppoe-server]interface Virtual-Template 1    #创建虚拟接口1
1 N9 z' ?* ^. A: l[pppoe-server-Virtual-Template1]ip add 10.1.12.2 24                   #虚拟接口1的地址
[pppoe-server-Virtual-Template1]ppp authentication-mode chap   #认证类型
[pppoe-server-Virtual-Template1]remote address pool pokes      #客户端的地址池pokes
[pppoe-server-Virtual-Template1]dis th
interface Virtual-Template1
$ f5 T) \8 i$ q- E( k ppp authentication-mode chap
remote address pool pokes
ip address 10.1.12.2 255.255.255.0

[pppoe-server]int g0/0/0       
[pppoe-server-GigabitEthernet0/0/0]pppoe-server bind virtual-template 1   #将虚拟接口1关联到g0/0/0接口
' S) a, ?/ x$ _* j, d[pppoe-server-GigabitEthernet0/0/0]dis th
[V200R003C00]
+ V% I: M9 f, p$ \9 i#
* J7 a! i/ q; g9 Uinterface GigabitEthernet0/0/0
1 y) Q! ?) E8 c) U pppoe-server bind Virtual-Template 1
#
return
3 g# J: F+ b3 q7 Z2 Q, w[pppoe-server-GigabitEthernet0/0/0]
5 v! |5 I. q+ I+ b+ g
3、创建pppoe拨号的账号
0 v. W% ?) a. O# {# ?8 O按理我们应该创建pppoe拨号的账号。
这里为了演示拨号失败，我们这里先不新建账号，后面再新建。
+ p2 @6 C% f$ F  N( @/ a  Z' V- k/ C
二、pppoe-client的配置
0 F! `# I3 l) h1 @[pppoe-client]dialer-rule   
[pppoe-client-dialer-rule]dialer-rule 1 ?
& `/ b1 Y: Y0 P  acl   Permit or deny based on access-list   
. X# O. G. u" C2 q  ip    Ip
  s' _$ ]6 o3 s# I6 A# a' l  ipv6  Ipv6       
: _- r! i* g8 i* E2 q9 B[pppoe-client-dialer-rule]dialer-rule 1 ip permit   #创建拨号规则，允许ip流量触发拨号
* p5 b9 @2 A1 h! h
[pppoe-client]interface Dialer 1
Jul 15 2021 18:55:22-08:00 pppoe-client %%01IFPDT/4/IF_STATE(l)[0]:Interface Dia
' X5 k. Q/ e9 |6 w1 P6 nler1 has turned into UP state.
+ M9 T: W/ L7 S: Z0 V( B& Q( A[pppoe-client-Dialer1]ip add       
$ {0 U' Z7 A2 {+ J2 G1 X3 J[pppoe-client-Dialer1]ip address ppp       
[pppoe-client-Dialer1]ip address ppp-negotiate  #地址采用ppp协商

[pppoe-client]interface Dialer 1                #创建接口拨号组1
[pppoe-client-Dialer1]ip address ppp-negotiate  #ip地址采用ppp协商
[pppoe-client-Dialer1]dialer user zhprny        #此用户不用于认证，是标识作用以及和dialer绑定
[pppoe-client-Dialer1]dialer bundle 1           #设备通过Dialer bundle将物理接口与拨号接口关联起来。
[pppoe-client-Dialer1]dialer-group 1             #放到一个拨号访问组1中
, s# }9 X0 N* [1 [. [: _[pppoe-client-Dialer1]ppp chap user pokes        #指定dialer1接口的编号，拨号账号
[pppoe-client-Dialer1]ppp chap password 123456   #拨号的密码
& m1 q- Q0 o& |# m" b: v- u

' n9 A( I6 d0 b[pppoe-client-Dialer1]dis th
[V200R003C00]
8 I: V# G; E- e* u0 g- B: u2 x6 `  \#
interface Dialer1
1 s8 C. ]( v- E2 Q link-protocol ppp
ppp chap user pokes
ppp chap password cipher %$%$I/!'WCyd<7p[~8;,>51L,$sl%$%$
ip address ppp-negotiate
8 B& |. d) A' m' ` dialer user zhprny
dialer bundle 1
: @+ ^+ m" O& B, p1 W. g dialer-group 1

; p* T6 o9 F2 a( i3 ^6 P[pppoe-client-GigabitEthernet0/0/0]
# C, R3 ]: y4 I, hJul 15 2021 19:07:54-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[0]:The line pr
' p" i  @# }( z3 D& B. r6 lotocol PPP on the interface Dialer1:0 has entered the UP state.  #PPP已进入启动状态
[pppoe-client-GigabitEthernet0/0/0]
1 c$ i* a# v$ b, o1 _/ RJul 15 2021 19:07:54-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[1]:The line pr
7 c- Y, \. f; ]8 {6 _$ i+ Y' motocol PPP on the interface Dialer1:0 has entered the DOWN state. #PPP已进入关闭状态

#不停的循环。。。。


- |0 e! F1 q! l& ~8 [8 l#原因是没有认证成功，因为我们在PPPOE-server上面还没有创建认证用户和密码
. `- h1 t# [9 P3 K. E' |
6 f7 V0 U" _  K, Y三、pppoe服务器上新建认证用户
我们到服务器上直接新建认证用户：
  g1 n. B0 d1 E+ |8 f8 V
( h) u6 v% Z8 |( c8 X$ k% W[pppoe-server]aaa
! i6 k- n, C8 g6 O[pppoe-server-aaa]local-user pokes password cipher 123456
Info: Add a new user.
; F7 D  T6 B( b& w[pppoe-server-aaa]local-user pokes service-type ppp    #类型为ppp
3 T8 {9 L5 {( N, x
- H' n  W0 z$ [
- ?4 W! @8 Q; W! N# w& _7 M四、客户端验证结果
& w. L  X) G- l8 N1、认证成功信息
) H( }( Z' Q7 M8 C) {& B然后客户端就会出现认证成功的提示：

[pppoe-client-GigabitEthernet0/0/0]
Jul 15 2021 19:09:23-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[10]:The line p
( a& r* d  `. k' Rrotocol PPP on the interface Dialer1:0 has entered the UP state.
1 Q# S" H% d4 t! r* F9 _[pppoe-client-GigabitEthernet0/0/0]
4 G+ c+ g& z; s  f( U, QJul 15 2021 19:09:23-08:00 pppoe-client %%01IFNET/4/LINK_STATE(l)[11]:The line p
7 \* y% W& p/ v& L9 p* }) arotocol PPP IPCP on the interface Dialer1:0 has entered the UP state.
0 l1 x) s( e5 s% }, J  K[pppoe-client-GigabitEthernet0/0/0]q
. d& [. {( L2 T; z[pppoe-client]dis ip in b
: r4 V* L2 p7 C/ j3 U*down: administratively down
5 ~- g& l4 y3 M, O$ Y^down: standby
(l): loopback
(s): spoofing
The number of interface that is UP in Physical is 4
" \8 R  A1 q6 V8 x" DThe number of interface that is DOWN in Physical is 0
( Y* g2 C( O7 |2 `: w$ y  OThe number of interface that is UP in Protocol is 3
$ L- S% w9 j+ J4 nThe number of interface that is DOWN in Protocol is 1

0 |1 K$ s: @$ mInterface                         IP Address/Mask      Physical   Protocol  
5 ^: r9 s) v- Z( vDialer1                           10.1.12.254/32       up         up(s)     #拿到了PPPOE服务器上的地址
GigabitEthernet0/0/0              unassigned           up         down      
GigabitEthernet0/0/1              192.168.1.254/24     up         up        
NULL0                             unassigned           up         up(s)

0 T7 o4 @7 s1 t  E% M# ~% k
2、pppoe-server 信息
<pppoe-server>dis interface Virtual-Template 1
$ V9 K( {3 b+ t( m1 l- ^9 ~Virtual-Template1 current state : UP
/ G& S+ ?0 ]: LLine protocol current state : UP
Last line protocol up time : 2021-07-15 19:09:22 UTC-08:00
Description:HUAWEI, AR Series, Virtual-Template1 Interface
Route Port,The Maximum Transmit Unit is 1492, Hold timer is 10(sec)
1 ?# q7 k( y: G: _/ w6 I8 m- VInternet Address is 10.1.12.2/24
- G* f2 ~% @& E; K, X3 t' G+ KLink layer protocol is PPP
6 {) x3 N$ P0 B& A+ ^LCP initial
- b3 W! }8 s. \" ~4 m; ?Physical is None
5 x/ _: L) T* U( d9 K/ Z3 \Current system time: 2021-07-15 20:27:28-08:00
$ X4 c8 F( B, E    Last 300 seconds input rate 0 bits/sec, 0 packets/sec
- H, i; I9 z+ D5 C    Last 300 seconds output rate 0 bits/sec, 0 packets/sec
4 P' y9 @/ M" b& Z0 w; i( C- d    Realtime 0 seconds input rate 0 bits/sec, 0 packets/sec
! ]' h; x$ O* W% G2 @, Y' k    Realtime 0 seconds output rate 0 bits/sec, 0 packets/sec
; z+ B4 V2 h9 ~: D  b9 z( x7 _    Input: 0 bytes
- [+ ]6 x7 @) m9 u0 h    Output:0 bytes
    Input bandwidth utilization  :    0%
    Output bandwidth utilization :    0%
4 A6 r7 ?% @2 f6 g' z6 ~
, W5 ^! _+ y$ A5 `. B<pppoe-server>
/ |' j7 m- Z7 u* O: w% o' R2 p, z

! M/ R2 z+ F9 d0 I. Q: E9 _3、pppoe-client信息
7 b- ]. P* g% y) G<pppoe-client>dis interface Dialer 1
Dialer1 current state : UP
Line protocol current state : UP (spoofing)
Description:HUAWEI, AR Series, Dialer1 Interface
Route Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)
7 H7 }; F$ w% j( P$ aInternet Address is negotiated, 10.1.12.254/32
* {$ P$ j% c5 s8 k% Z) L0 M2 x* `Link layer protocol is PPP
: p! v. U* B+ Y; r1 w# lLCP initial
Physical is Dialer
% x, Q! a" }3 ^0 n! ^; \3 Q* eCurrent system time: 2021-07-15 20:23:56-08:00
0 e/ |" C; Z# G1 e7 Z: U    Last 300 seconds input rate 0 bits/sec, 0 packets/sec
    Last 300 seconds output rate 0 bits/sec, 0 packets/sec
% W) s' c) Q& p9 w" G  ^$ R# {    Realtime 0 seconds input rate 0 bits/sec, 0 packets/sec
4 ^7 U/ L2 f+ v+ q    Realtime 0 seconds output rate 0 bits/sec, 0 packets/sec
- S' M  R$ L* Z7 @- c    Input: 0 bytes
7 _( f. \+ X) @, H, \    Output:0 bytes
    Input bandwidth utilization  :    0%
    Output bandwidth utilization :    0%
Bound to Dialer1:0:
- \' u' f' L2 ^0 [Dialer1:0 current state : UP ,
! g! ^% v9 B3 [5 {. _: ^& e3 q7 j! lLine protocol current state : UP
3 [* `' |/ K: r5 u' L
6 a: }- M; O4 i( e- O, j2 KLink layer protocol is PPP
LCP opened, IPCP opened
; A% G- C) E- p% W4 Z9 m$ b, m' {( gPackets statistics:
9 q1 Q3 V1 D' }2 E# I" O: o3 C8 Q  Input packets:0,  0 bytes
- `3 ]7 q* M- t. i  Output packets:4, 336 bytes
5 T& d6 y7 M  w! n, E: q# h: `  FCS error packets:0
  Address error packets:0
  Control field control error packets:0

% Y0 \  I, V" Q. B& S( u+ a" S
<pppoe-client>

3 Z) j# x% a5 v( \五、NAT的配置
  y! Y$ I( k* b7 h用PC2直接ping 10.1.12.254是可以通的。10.1.12.254是AR1的g0/0/0口获取到的地址，其实就是我们常说的WAN口地址。
6 y6 ]' z8 d  t% N: b1 ?! K% G
2 J& f; O8 [! `$ WPC2>ping 10.1.12.254

Ping 10.1.12.254: 32 data bytes, Press Ctrl_C to break
From 10.1.12.254: bytes=32 seq=1 ttl=255 time=63 ms
From 10.1.12.254: bytes=32 seq=2 ttl=255 time=31 ms
From 10.1.12.254: bytes=32 seq=3 ttl=255 time=47 ms
From 10.1.12.254: bytes=32 seq=4 ttl=255 time=31 ms
+ z7 [- X7 g; p. h) Z* V4 fFrom 10.1.12.254: bytes=32 seq=5 ttl=255 time=47 ms

6 G+ S  u* D' `* v& c--- 10.1.12.254 ping statistics ---
: F# `- b4 l% ?, K; L/ X  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 31/43/63 ms
) N' q1 x2 l" j
7 }2 l  F( Q+ d) ~- G& K6 ], aPC2>ping 10.1.12.2
$ h9 D% a2 V) D# c0 V
3 m2 v6 _2 @6 ]& v1 X( x0 H  iPing 10.1.12.2: 32 data bytes, Press Ctrl_C to break
$ H0 g2 C/ m3 B9 ^0 V: Z& ~Request timeout!
2 I! l. A6 v. z4 r/ TRequest timeout!
Request timeout!
# ^% }. k  Y1 qRequest timeout!
Request timeout!
+ Z3 [! V* M4 ~2 U1 [0 B
--- 10.1.12.2 ping statistics ---
  5 packet(s) transmitted
8 G( E! j9 ]# J/ \' J% O  0 packet(s) received
  100.00% packet loss
#但是无法ping通10.1.12.2
3 v1 n  f" G: m0 E) v2 J* N) V" p6 A7 e
' s& h' d0 ]+ t; x
无法ping通10.1.12.2的原因是：我们没有做NAT .接下来我们在pppoe-client上面做NAT
& V& Y5 b4 B6 a, V
1、这里配置规则2000
[pppoe-client]acl number 2000       
8 F+ c0 d2 o% K8 }8 q[pppoe-client-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255

# `5 ~/ _- l- i3 l. ^& l2 |2、将规则2000绑定到接口
4 ]' `6 @$ l& U, _) `如下接口信息，需要注意的是pppoe的接口是Dialer1，并不是GigabitEthernet0/0/0口。我们必须将规则绑定在Dialer1口，最容易犯错的就是直接绑定在g0/0/0口。
& l8 V5 l1 t/ k% H3 m: U5 h- Z; Z
1 E! F- f! u/ K9 s; T/ ?4 ]6 \[pppoe-client]dis ip int b
*down: administratively down
^down: standby
(l): loopback
! s& m1 I3 j( c7 j( p" a(s): spoofing
The number of interface that is UP in Physical is 4
: O. \' G# W. y3 i% uThe number of interface that is DOWN in Physical is 0
The number of interface that is UP in Protocol is 3
, D) t# E) V5 E8 c/ V# yThe number of interface that is DOWN in Protocol is 1
' X/ L# q/ H7 y" g' A' I, r
  o" l* ^( z/ @8 b$ S7 v5 nInterface                         IP Address/Mask      Physical   Protocol  
Dialer1                           10.1.12.254/32       up         up(s)     
- R( ]  c2 b* }% o9 U2 C' d: p# jGigabitEthernet0/0/0              unassigned           up         down      
/ q4 y; V, ^' E$ j6 [! m6 eGigabitEthernet0/0/1              192.168.1.254/24     up         up        
% H. Q4 ?) B4 P3 c0 RNULL0                             unassigned           up         up(s)     
[pppoe-client]
' s5 f: _! n$ `. {# c2 t8 q& n, B
[pppoe-client]int Dialer 1       
[pppoe-client-Dialer1]nat outbound 2000
0 p% L( j8 f) _* ?[pppoe-client-Dialer1]dis th
1 \4 s! M1 s3 k' Q[V200R003C00]
#
( i% h  ?2 x0 [interface Dialer1
link-protocol ppp
ppp chap user pokes
ppp chap password cipher %$%$I/!'WCyd<7p[~8;,>51L,$sl%$%$
4 w6 `/ s/ i( c& m# O4 ~9 D ip address ppp-negotiate
dialer user zhprny
& q) v4 y; F7 `0 {! J0 j dialer bundle 1
& E9 j/ q4 ]" E# L1 Z dialer-group 1
nat outbound 2000
3 _9 \  \9 {% m#
  k2 y3 M% o% C. c; ereturn
2 c, n' Y  {/ y% ?[pppoe-client-Dialer1]

% L. }# T  I6 z接下来我们就可以ping通10.1.12.2 了。
1 M, u  X& d/ n( r0 ~
PC2>ping 10.1.12.2

1 F$ A( S: g7 MPing 10.1.12.2: 32 data bytes, Press Ctrl_C to break
From 10.1.12.2: bytes=32 seq=1 ttl=254 time=31 ms
From 10.1.12.2: bytes=32 seq=2 ttl=254 time=32 ms
% o- P( T# o- N8 HFrom 10.1.12.2: bytes=32 seq=3 ttl=254 time=46 ms
0 }3 t- {& ?' M" Z! eFrom 10.1.12.2: bytes=32 seq=4 ttl=254 time=32 ms
) Q4 @4 x2 f4 F* ~! B1 j; jFrom 10.1.12.2: bytes=32 seq=5 ttl=254 time=31 ms

--- 10.1.12.2 ping statistics ---
8 h/ N0 i4 O7 H' ~" g' \9 l# H  5 packet(s) transmitted
) v8 p' G5 L, Y4 p7 T2 k  5 packet(s) received
/ Y! W) H3 g! ]. M, f) l  V' l  0.00% packet loss
( H& y; h0 w* y9 V5 w/ l7 O  round-trip min/avg/max = 31/34/46 ms
- g- P% O: F- V3 D' F+ ~3 Z
5 T: R; @6 ^( _