一、实验拓扑二、实验需求1.R5为ISP只能进行IP地址配置其所有地址均配为公有IP地址;2.R1和R5间使用PPP的PAP认证R5为主认证方;R2与R5之间使用ppp的CHAP认证R5为主认证方;R3与R5之间使用HDLC封装3.R1、R2、R3构建一个MGRE环境R1为中心站点R1、R4间为点到点的GRE;4.整个私有网络基本RIP全网可达5.所有PC设置私有IP为源IP可以访问R5环回。三、实验配置思路1.配置ip地址2.pap、chap认证配置主验证方和被验证方hdlc链路封装3.配置静态路由协议打通公网4.配置MGRE和rip传递两端私网路由5.配置GRE和rip传递私网路由6.配置EASYIP NAT实现PC访问R5环回地址7.测试全网通四、实验步骤1.配置IP地址PC1PC2PC3PC4AR1[R1]interface g0/0/0[R1-GigabitEthernet0/0/0]ip address 192.168.1.254 24[R1-GigabitEthernet0/0/0]interface serial 4/0/0[R1-Serial4/0/0]ip address 15.1.1.1 24AR2[R2]interface g0/0/0[R2-GigabitEthernet0/0/0]ip address 192.168.2.254 24[R2-GigabitEthernet0/0/0]interface serial 4/0/0[R2-Serial4/0/0]ip address 25.1.1.2 24AR3[R3]interface g0/0/0[R3-GigabitEthernet0/0/0]ip address 192.168.3.254 24[R3-GigabitEthernet0/0/0]interface serial 4/0/0[R3-Serial4/0/0]ip address 35.1.1.3 24AR4[R4]interface g0/0/1[R4-GigabitEthernet0/0/1]ip address 192.168.4.254 24[R4-GigabitEthernet0/0/1]interface g0/0/0[R4-GigabitEthernet0/0/0]ip address 45.1.1.4 24AR5[R5]interface Serial 4/0/1[R5-Serial4/0/1]ip address 15.1.1.5 24[R5-Serial4/0/1]interface Serial 3/0/1[R5-Serial3/0/1]ip address 25.1.1.5 24[R5-Serial3/0/1]interface Serial 4/0/0[R5-Serial4/0/0]ip address 35.1.1.5 24[R5-Serial4/0/0]interface g0/0/0[R5-GigabitEthernet0/0/0]ip address 45.1.1.5 24[R5]interface LoopBack 0[R5-LoopBack0]ip address 5.5.5.5 242.配置静态路由打通全网[R1]ip route-static 0.0.0.0 0 15.1.1.5[R2]ip route-static 0.0.0.0 0 25.1.1.5[R3]ip route-static 0.0.0.0 0 35.1.1.5[R4]ip route-static 0.0.0.0 0 45.1.1.5测试3. 在R5上创建用户验证R1的用户[R5]aaa[R5-aaa]local-user zhangsan password cipher zs123 privilege level 15[R5-aaa]local-user zhangsan service-type ppp[R5]interface Serial 4/0/1[R5-Serial4/0/1]ppp authentication-mode pap4. 在R5相连的接口上配置需要进行PPP验证验证方式为pap并配置对端验证本端的用户名[R1]interface Serial 4/0/0[R1-Serial4/0/0]ppp pap local-user zhangsan password cipher zs1235. 在R5上创建用户验证R2的用户(用的还是上述的账号zhangsan和密码:zs123)[R5]interface Serial 3/0/1[R5-Serial3/0/1]ppp authentication-mode chap6. 在R5相连的接口上配置需要进行PPP验证验证方式为chap并配置对端验证本端的用户名[R2]interface Serial 4/0/0[R2-Serial4/0/0]ppp chap user zhangsan[R2-Serial4/0/0]ppp chap password cipher zs1237.修改两边接口AR5:Serial 4/0/0和AR3:Serial 4/0/0的链路协议[R5]interface Serial 4/0/0[R5-Serial4/0/0]link-protocol hdlc[R3]interface Serial 4/0/0[R3-Serial4/0/0]link-protocol hdlc8.配置MGRE VPN配置总部与分部之间的隧道[R1]interface Tunnel 0/0/0[R1-Tunnel0/0/0]ip address 10.1.2.1 24[R1-Tunnel0/0/0]tunnel-protocol gre p2mp[R1-Tunnel0/0/0]source 15.1.1.1[R2]interface Tunnel 0/0/0[R2-Tunnel0/0/0]ip address 10.1.2.2 24[R2-Tunnel0/0/0]tunnel-protocol gre p2mp[R2-Tunnel0/0/0]source serial 4/0/0[R3]interface Tunnel 0/0/0[R3-Tunnel0/0/0]ip address 10.1.2.3 24[R3-Tunnel0/0/0]tunnel-protocol gre p2mp[R3-Tunnel0/0/0]source serial 4/0/09. NHRP的配置中心站点配置[R1-Tunnel0/0/0]nhrp network-id 100分支站点配置[R2]interface Tunnel 0/0/0[R2-Tunnel0/0/0]nhrp network-id 100[R2-Tunnel0/0/0]nhrp entry 10.1.2.1 15.1.1.1 register[R3]interface Tunnel 0/0/0[R3-Tunnel0/0/0]nhrp network-id 100[R3-Tunnel0/0/0]nhrp entry 10.1.2.1 15.1.1.1 register10.配置RIP路由协议来传递两端私网路由[R1]rip 1[R1-rip-1]undo summary[R1-rip-1]version 2[R1-rip-1]network 192.168.1.0[R1-rip-1]network 10.0.0.0[R2]rip 1[R2-rip-1]undo summary[R2-rip-1]version 2[R2-rip-1]network 192.168.2.0[R2-rip-1]network 10.0.0.0[R3]rip 1[R3-rip-1]undo summary[R3-rip-1]version 2[R3-rip-1]network 192.168.3.0[R3-rip-1]network 10.0.0.0查看各个设备的RIP路由表学习情况会发现只有中心站点学习到了分支站点的网段而分支站点没有学习到任何其他站点的网点。R3和R2一样在中心站点上开启伪广播功能但是只能学习到中心站点的[R1-Tunnel0/0/0]nhrp entry multicast dynamic于是关水平分割中心和分支都要[R1-Tunnel0/0/0]undo rip split-horizon[R2-Tunnel0/0/0]undo rip split-horizon[R3-Tunnel0/0/0]undo rip split-horizon11.配置GRE[R1]interface Tunnel 0/0/1[R1-Tunnel0/0/1]tunnel-protocol gre[R1-Tunnel0/0/1]ip address 10.1.1.1 24[R1-Tunnel0/0/1]source 15.1.1.1[R1-Tunnel0/0/1]destination 45.1.1.4[R4]interface Tunnel 0/0/1[R4-Tunnel0/0/1]tunnel-protocol gre[R4-Tunnel0/0/1]ip address 10.1.1.4 24[R4-Tunnel0/0/1]source 45.1.1.4[R4-Tunnel0/0/1]destination 15.1.1.112.转递私网路由[R1]rip 1[R1-rip-1]display this对于R1因为前面已经宣告了所以这里就不用了[R4]rip 1[R4-rip-1]undo summary[R4-rip-1]version 2[R4-rip-1]network 192.168.4.0[R4-rip-1]network 10.0.0.013.测试全网可达总部跟分部PC1分部和分部PC214.配置EASYIP NAT实现PC访问R5环回地址[R1]acl 2000[R1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255[R1-acl-basic-2000]quit[R1]interface Serial 4/0/0[R1-Serial4/0/0]nat outbound 2000[R2]acl 2000[R2-acl-basic-2000]rule permit source 192.168.2.0 0.0.0.255[R2-acl-basic-2000]quit[R2]interface Serial 4/0/0[R2-Serial4/0/0]nat outbound 2000[R3]acl 2000[R3-acl-basic-2000]rule permit source 192.168.3.0 0.0.0.255[R3-acl-basic-2000]quit[R3]interface Serial 4/0/0[R3-Serial4/0/0]nat outbound 2000[R4]acl 2000[R4-acl-basic-2000]rule permit source 192.168.4.0 0.0.0.255[R4-acl-basic-2000]quit[R4]interface g0/0/0[R4-GigabitEthernet0/0/0]nat outbound 200015.测试全网通PC1PC2PC3PC4 一、实验拓扑二、实验需求1.R5为ISP只能进行IP地址配置其所有地址均配为公有IP地址;2.R1和R5间使用PPP的PAP认证R5为主认证方;R2与R5之间使用ppp的CHAP认证R5为主认证方;R3与R5之间使用HDLC封装3.R1、R2、R3构建一个MGRE环境R1为中心站点R1、R4间为点到点的GRE;4.整个私有网络基本RIP全网可达5.所有PC设置私有IP为源IP可以访问R5环回。三、实验配置思路1.配置ip地址2.pap、chap认证配置主验证方和被验证方hdlc链路封装3.配置静态路由协议打通公网4.配置MGRE和rip传递两端私网路由5.配置GRE和rip传递私网路由6.配置EASYIP NAT实现PC访问R5环回地址7.测试全网通四、实验步骤1.配置IP地址PC1PC2PC3PC4AR1[R1]interface g0/0/0[R1-GigabitEthernet0/0/0]ip address 192.168.1.254 24[R1-GigabitEthernet0/0/0]interface serial 4/0/0[R1-Serial4/0/0]ip address 15.1.1.1 24AR2[R2]interface g0/0/0[R2-GigabitEthernet0/0/0]ip address 192.168.2.254 24[R2-GigabitEthernet0/0/0]interface serial 4/0/0[R2-Serial4/0/0]ip address 25.1.1.2 24AR3[R3]interface g0/0/0[R3-GigabitEthernet0/0/0]ip address 192.168.3.254 24[R3-GigabitEthernet0/0/0]interface serial 4/0/0[R3-Serial4/0/0]ip address 35.1.1.3 24AR4[R4]interface g0/0/1[R4-GigabitEthernet0/0/1]ip address 192.168.4.254 24[R4-GigabitEthernet0/0/1]interface g0/0/0[R4-GigabitEthernet0/0/0]ip address 45.1.1.4 24AR5[R5]interface Serial 4/0/1[R5-Serial4/0/1]ip address 15.1.1.5 24[R5-Serial4/0/1]interface Serial 3/0/1[R5-Serial3/0/1]ip address 25.1.1.5 24[R5-Serial3/0/1]interface Serial 4/0/0[R5-Serial4/0/0]ip address 35.1.1.5 24[R5-Serial4/0/0]interface g0/0/0[R5-GigabitEthernet0/0/0]ip address 45.1.1.5 24[R5]interface LoopBack 0[R5-LoopBack0]ip address 5.5.5.5 242.配置静态路由打通全网[R1]ip route-static 0.0.0.0 0 15.1.1.5[R2]ip route-static 0.0.0.0 0 25.1.1.5[R3]ip route-static 0.0.0.0 0 35.1.1.5[R4]ip route-static 0.0.0.0 0 45.1.1.5测试3. 在R5上创建用户验证R1的用户[R5]aaa[R5-aaa]local-user zhangsan password cipher zs123 privilege level 15[R5-aaa]local-user zhangsan service-type ppp[R5]interface Serial 4/0/1[R5-Serial4/0/1]ppp authentication-mode pap4. 在R5相连的接口上配置需要进行PPP验证验证方式为pap并配置对端验证本端的用户名[R1]interface Serial 4/0/0[R1-Serial4/0/0]ppp pap local-user zhangsan password cipher zs1235. 在R5上创建用户验证R2的用户(用的还是上述的账号zhangsan和密码:zs123)[R5]interface Serial 3/0/1[R5-Serial3/0/1]ppp authentication-mode chap6. 在R5相连的接口上配置需要进行PPP验证验证方式为chap并配置对端验证本端的用户名[R2]interface Serial 4/0/0[R2-Serial4/0/0]ppp chap user zhangsan[R2-Serial4/0/0]ppp chap password cipher zs1237.修改两边接口AR5:Serial 4/0/0和AR3:Serial 4/0/0的链路协议[R5]interface Serial 4/0/0[R5-Serial4/0/0]link-protocol hdlc[R3]interface Serial 4/0/0[R3-Serial4/0/0]link-protocol hdlc8.配置MGRE VPN配置总部与分部之间的隧道[R1]interface Tunnel 0/0/0[R1-Tunnel0/0/0]ip address 10.1.2.1 24[R1-Tunnel0/0/0]tunnel-protocol gre p2mp[R1-Tunnel0/0/0]source 15.1.1.1[R2]interface Tunnel 0/0/0[R2-Tunnel0/0/0]ip address 10.1.2.2 24[R2-Tunnel0/0/0]tunnel-protocol gre p2mp[R2-Tunnel0/0/0]source serial 4/0/0[R3]interface Tunnel 0/0/0[R3-Tunnel0/0/0]ip address 10.1.2.3 24[R3-Tunnel0/0/0]tunnel-protocol gre p2mp[R3-Tunnel0/0/0]source serial 4/0/09. NHRP的配置中心站点配置[R1-Tunnel0/0/0]nhrp network-id 100分支站点配置[R2]interface Tunnel 0/0/0[R2-Tunnel0/0/0]nhrp network-id 100[R2-Tunnel0/0/0]nhrp entry 10.1.2.1 15.1.1.1 register[R3]interface Tunnel 0/0/0[R3-Tunnel0/0/0]nhrp network-id 100[R3-Tunnel0/0/0]nhrp entry 10.1.2.1 15.1.1.1 register10.配置RIP路由协议来传递两端私网路由[R1]rip 1[R1-rip-1]undo summary[R1-rip-1]version 2[R1-rip-1]network 192.168.1.0[R1-rip-1]network 10.0.0.0[R2]rip 1[R2-rip-1]undo summary[R2-rip-1]version 2[R2-rip-1]network 192.168.2.0[R2-rip-1]network 10.0.0.0[R3]rip 1[R3-rip-1]undo summary[R3-rip-1]version 2[R3-rip-1]network 192.168.3.0[R3-rip-1]network 10.0.0.0查看各个设备的RIP路由表学习情况会发现只有中心站点学习到了分支站点的网段而分支站点没有学习到任何其他站点的网点。R3和R2一样在中心站点上开启伪广播功能但是只能学习到中心站点的[R1-Tunnel0/0/0]nhrp entry multicast dynamic于是关水平分割中心和分支都要[R1-Tunnel0/0/0]undo rip split-horizon[R2-Tunnel0/0/0]undo rip split-horizon[R3-Tunnel0/0/0]undo rip split-horizon11.配置GRE[R1]interface Tunnel 0/0/1[R1-Tunnel0/0/1]tunnel-protocol gre[R1-Tunnel0/0/1]ip address 10.1.1.1 24[R1-Tunnel0/0/1]source 15.1.1.1[R1-Tunnel0/0/1]destination 45.1.1.4[R4]interface Tunnel 0/0/1[R4-Tunnel0/0/1]tunnel-protocol gre[R4-Tunnel0/0/1]ip address 10.1.1.4 24[R4-Tunnel0/0/1]source 45.1.1.4[R4-Tunnel0/0/1]destination 15.1.1.112.转递私网路由[R1]rip 1[R1-rip-1]display this对于R1因为前面已经宣告了所以这里就不用了[R4]rip 1[R4-rip-1]undo summary[R4-rip-1]version 2[R4-rip-1]network 192.168.4.0[R4-rip-1]network 10.0.0.013.测试全网可达总部跟分部PC1分部和分部PC214.配置EASYIP NAT实现PC访问R5环回地址[R1]acl 2000[R1-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255[R1-acl-basic-2000]quit[R1]interface Serial 4/0/0[R1-Serial4/0/0]nat outbound 2000[R2]acl 2000[R2-acl-basic-2000]rule permit source 192.168.2.0 0.0.0.255[R2-acl-basic-2000]quit[R2]interface Serial 4/0/0[R2-Serial4/0/0]nat outbound 2000[R3]acl 2000[R3-acl-basic-2000]rule permit source 192.168.3.0 0.0.0.255[R3-acl-basic-2000]quit[R3]interface Serial 4/0/0[R3-Serial4/0/0]nat outbound 2000[R4]acl 2000[R4-acl-basic-2000]rule permit source 192.168.4.0 0.0.0.255[R4-acl-basic-2000]quit[R4]interface g0/0/0[R4-GigabitEthernet0/0/0]nat outbound 200015.测试全网通PC1PC2PC3PC4 
指南：搜索引擎侦察层)
