Lab Objective:
The focus of this lab is to understand PPP over Ethernet (PPPoE) implementation and configuration. Additional technologies tested include CHAP authentication and NAT.
Lab Topology:
The lab network topology is illustrated below:
|
IMPORTANT NOTE If you are using the www.howtonetwork.net racks, please bring up the LAN interfaces connected to the routers by issuing the no shutdown command on the connected switches. If you are using a home lab with no interface fastethernet 0/0 Alternately, you can simply connect the interfaces to a hub or switch if you have one available in your own lab. |
Task 1
Configure hostnames, IP addressing on all routers as illustrated in the network topology. Configure an IP address of 150.1.1.1/24 on the LAN interface of R1. Do NOT configure an address on the LAN interface of R4.
Task 2
Configure BGP between R1 and R2 as illustrated in the topology. Advertise the 150.2.2.0/24 subnet via BGP and verify that R1 can reach this subnet. Do NOT advertise the 150.1.1.0/24 subnet connected to R1 via BGP. Verify the configuration using the appropriate commands.
Task 3
Assume that router R1 is an ISP router. This router will be a ‘server’ for client router R4. This router should have the following PPPoE configuration applied to it:
NOTE: This task is provided to you because these configurations are beyond the scope of the current CCNP curriculum. Simple copy and paste this configuration or manually type it in to complete the task. There are no additional configurations required to complete this task.
| username ROUTER4 password CCNP2011 ! bba-group pppoe global virtual-template 1 ! interface fastethernet0/0 pppoe enable group global ! interface virtual-template1 mtu 1492 ip unnumbered fastethernet0/0 peer default ip address pool CLIENT-POOL ppp authentication chap ! ip local pool CLIENT-POOL 150.1.1.100 150.1.1.254 |
Task 4
Given the configuration above on R1 (ISP Router), implement PPPoE on R4. Next, verify your configuration using the appropriate commands. Test your solution by ensuring that R4 is able to ping 150.1.1.1 (R1), which should be its default gateway.
Task 5
Configure R1 so that R4 is able to reach R2s LAN subnet; however, R2 should never be able to initiate a connection to R4. Verify your configuration using the appropriate commands. When completing this task, you MUST adhere to the following restrictions:
- You are NOT allowed to use any static routes on any routers
- You are NOT allowed to advertise a default via BGP
- You are NOT allowed to advertise the 150.1.1.0/24 subnet via BGP
- You are NOT allowed to redistribute any routes
Following completion, ensure that R1 can ping R2s LAN subnet, but not vice-versa.
Lab Validation
Task 1
Please refer to previous labs for basic IPv4 addressing and hostname configuration. This will not be included in this section to avoid being redundant.
Task 2
Please refer to previous labs for basic BGP configuration. Next, verify your BGP configuration using the show ip bgp summary and show ip routecommands. Following this configuration, the BTP routing tables on R1 and R2 should show the following route entries:
| R1#show ip bgp BGP table version is 4, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
| R2#show ip bgp BGP table version is 5, local router ID is 2.2.2.2 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
Task 3
The requirements of this task are straightforward. Simply paste the configuration into the router as specified. No additional configuration is required to complete this task.
Task 4
The requirements of this task are similar to those of the previous lab with the only difference being that this time CHAP security is used instead of PAP This task is completed as follows:
| R4(config)#interface fastethernet 0/0 R4(config-if)#no shutdown R4(config-if)#no ip address R4(config-if)#pppoe enable R4(config-if)#pppoe-client dial-pool-number 1 R4(config-if)#exit R4(config)#interface dialer 1 R4(config-if)#ip mtu 1492 R4(config-if)#ip address negotiated R4(config-if)#encapsulation ppp R4(config-if)#dialer pool 1 R4(config-if)#dialer-group 1 R4(config-if)#ppp authentication pap callin R4(config-if)#ppp chap hostname ROUTER4 R4(config-if)#ppp chap password CCNP2011 R4(config-if)#ppp ipcp route default R4(config-if)#exit |
Following this, verify that R4 has received an IP address from the pool configured on R1:
| R4#show ip interface brief Interface IP-Address OK? Method Status Protocol FastEthernet0/0 unassigned YES manual up up Serial0/0 unassigned YES manual administratively down down Serial0/1 unassigned YES TFTP administratively down down Virtual-Access1 unassigned YES unset up up Virtual-Access2 unassigned YES unset up up Dialer1 150.1.1.100 YES IPCP up up |
When PPPoE is enabled, the router automatically creates one or more Virtual-Access interfaces. You can view which Virtual-Access interface is associated with the Dialer interface using the show interfaces dialer <number> command as follows:
| R4#show interfaces dialer 1 Dialer1 is up, line protocol is up (spoofing) Hardware is Unknown Internet address is 150.1.1.100/32 MTU 1500 bytes, BW 56 Kbit/sec, DLY 20000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation PPP, loopback not set Keepalive set (10 sec) DTR is pulsed for 1 seconds on reset Interface is bound to Vi2 Last input never, output never, output hang never Last clearing of “show interface” counters 00:03:48 Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/0/16 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) Available Bandwidth 42 kilobits/sec 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 44 packets input, 616 bytes 44 packets output, 616 bytes Bound to: Virtual-Access2 is up, line protocol is up Hardware is Virtual Access interface MTU 1500 bytes, BW 56 Kbit/sec, DLY 20000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation PPP, LCP Open Listen: CDPCP Open: IPCP PPPoE vaccess, cloned from Dialer1 Vaccess status 0x44, loopback not set Keepalive set (10 sec) DTR is pulsed for 5 seconds on reset Interface is bound to Di1 (Encapsulation PPP) Last input 00:03:43, output never, output hang never Last clearing of “show interface” counters 00:03:44 Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 53 packets input, 749 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 52 packets output, 731 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 output buffer failures, 0 output buffers swapped out 0 carrier transitions |
Next, verify that the default route is installed. In the solution example, the ppp ipcp route default interface configuration command is applied under the Dialer interface. This command instructs router to add a default route to the routing table during PPP negotiation. This command is NOT supported in older IOS versions; therefore, you would complete the same solution using the ip route 0.0.0.0 0.0.0.0 dialer [number] global configuration command instead. Keep in mind that these commands are mutually exclusive. Use one or the other. You can NOT use both! Use the show ip routecommand to verify the default route:
| R4#show ip route Codes: C – connected, S – static, R – RIP, M – mobile, B – BGP D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2 E1 – OSPF external type 1, E2 – OSPF external type 2 i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2 ia – IS-IS inter area, * – candidate default, U – per-user static route o – ODR, P – periodic downloaded static route Gateway of last resort is 150.1.1.1 to network 0.0.0.0 150.1.0.0/32 is subnetted, 2 subnets |
Notice that the static route is installed into the routing table with a metric of 1, which is the same metric that would be assigned to a manually configured static route. Finally, complete task requirements by pinging from R4 to 150.1.1.1 (R1):
| R4#ping 150.1.1.1 repeat 10 size 1500
Type escape sequence to abort. |
Task 5
If you ignore the unnecessary banter, you will notice that this task requires that Port Address Translation, or NAT Overload, is required. This will allow R4 to ping R2, but not allow R2 to initiate inbound connections destined to R4. This task is completed as follows:
| R1(config)#interface virtual-template 1 R1(config-if)#ip nat inside R1(config-if)#exit R1(config)#interface serial 0/0 R1(config-if)#ip nat outside R1(config-if)#exit R1(config)#ip nat inside source list 100 interface serial 0/0 overload R1(config)#access-list 100 permit ip 150.1.1.0 0.0.0.255 any R1(config)#exit |
Following this configuration, test your solution by pinging between R4 and R2:
| R4#ping 150.2.2.2 repeat 10
Type escape sequence to abort. |
Next, verify NAT / PAT operation using the show ip nat translations command on R1:
| R1#show ip nat translations Pro Inside global Inside local Outside local Outside global icmp 150.2.1.1:1 150.1.1.100:1 150.2.2.2:1 150.2.2.2:1 |
Additional Information
To test or verify the PPP authentication method, simply enable PPP debugging on the router and the disable and re-enable the Dialer interface on R1, for example:
| R4(config)#logging console R4(config)#interface dialer 1 R4(config-if)#shutdown *Jun 16 05:04:26.099: Di1 DDR: dialer shutdown complete R4(config-if)#do debug ppp negotiation PPP protocol negotiation debugging is on R4(config-if)#do debug ppp authentication PPP authentication debugging is on R4(config-if)#no shutdown *Jun 16 05:04:59.271: %LINK-3-UPDOWN: Interface Dialer1, changed state to up *Jun 16 05:05:11.359: %DIALER-6-BIND: Interface Vi2 bound to profile Di1 *Jun 16 05:05:11.363: Vi2 PPP: Phase is DOWN, Setup *Jun 16 05:05:11.363: Vi2 PPP: Using dialer call direction *Jun 16 05:05:11.363: Vi2 PPP: Treating connection as a callout *Jun 16 05:05:11.363: Vi2 PPP: Session handle[71000007] Session id[0] *Jun 16 05:05:11.363: Vi2 PPP: Phase is ESTABLISHING, Active Open *Jun 16 05:05:11.363: Vi2 PPP: Authorization required *Jun 16 05:05:11.363: Vi2 PPP: No remote authentication for call-out *Jun 16 05:05:11.363: Vi2 LCP: O CONFREQ [Closed] id 1 len 10 *Jun 16 05:05:11.367: Vi2 LCP: MagicNumber 0x0F516A40 (0x05060F516A40) *Jun 16 05:05:11.367: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up *Jun 16 05:05:11.367: Vi2 LCP: I CONFREQ [REQsent] id 1 len 19 *Jun 16 05:05:11.371: Vi2 LCP: MRU 1492 (0x010405D4) *Jun 16 05:05:11.371: Vi2 LCP: AuthProto CHAP (0x0305C22305) *Jun 16 05:05:11.371: Vi2 LCP: MagicNumber 0x0F515128 (0x05060F515128) *Jun 16 05:05:11.371: Vi2 LCP: O CONFNAK [REQsent] id 1 len 8 *Jun 16 05:05:11.371: Vi2 LCP: MRU 1500 (0x010405DC) *Jun 16 05:05:11.371: Vi2 LCP: I CONFACK [REQsent] id 1 len 10 *Jun 16 05:05:11.371: Vi2 LCP: MagicNumber 0x0F516A40 (0x05060F516A40) *Jun 16 05:05:11.375: Vi2 LCP: I CONFREQ [ACKrcvd] id 2 len 19 *Jun 16 05:05:11.375: Vi2 LCP: MRU 1500 (0x010405DC) *Jun 16 05:05:11.375: Vi2 LCP: AuthProto CHAP (0x0305C22305) *Jun 16 05:05:11.375: Vi2 LCP: MagicNumber 0x0F515128 (0x05060F515128) *Jun 16 05:05:11.375: Vi2 LCP: O CONFACK [ACKrcvd] id 2 len 19 *Jun 16 05:05:11.375: Vi2 LCP: MRU 1500 (0x010405DC) *Jun 16 05:05:11.375: Vi2 LCP: AuthProto CHAP (0x0305C22305) *Jun 16 05:05:11.375: Vi2 LCP: MagicNumber 0x0F515128 (0x05060F515128) *Jun 16 05:05:11.379: Vi2 LCP: State is Open *Jun 16 05:05:11.379: Vi2 PPP: No authorization without authentication *Jun 16 05:05:11.379: Vi2 PPP: Phase is AUTHENTICATING, by the peer *Jun 16 05:05:11.379: Vi2 CHAP: I CHALLENGE id 1 len 23 from “R1” *Jun 16 05:05:11.383: Vi2 CHAP: Using hostname from interface CHAP *Jun 16 05:05:11.383: Vi2 CHAP: Using password from interface CHAP *Jun 16 05:05:11.383: Vi2 CHAP: O RESPONSE id 1 len 28 from “ROUTER4” *Jun 16 05:05:11.411: Vi2 CHAP: I SUCCESS id 1 len 4 *Jun 16 05:05:11.415: Vi2 PPP: Phase is FORWARDING, Attempting Forward *Jun 16 05:05:11.415: Vi2 PPP: Queue IPCP code[1] id[1] *Jun 16 05:05:11.415: Vi2 PPP SSS: Receive SSS-Mgr Connect-Local *Jun 16 05:05:11.419: Vi2 PPP: Phase is ESTABLISHING, Finish LCP *Jun 16 05:05:11.419: Vi2 PPP: Phase is UP *Jun 16 05:05:11.419: Vi2 IPCP: O CONFREQ [Closed] id 1 len 10 *Jun 16 05:05:11.419: Vi2 IPCP: Address 0.0.0.0 (0x030600000000) *Jun 16 05:05:11.423: Vi2 CDPCP: O CONFREQ [Closed] id 1 len 4 *Jun 16 05:05:11.423: Vi2 PPP: Process pending ncp packets *Jun 16 05:05:11.423: Vi2 IPCP: Redirect packet to Vi2 *Jun 16 05:05:11.423: Vi2 IPCP: I CONFREQ [REQsent] id 1 len 10 *Jun 16 05:05:11.423: Vi2 IPCP: Address 150.1.1.1 (0x030696010101) *Jun 16 05:05:11.423: Vi2 IPCP: O CONFACK [REQsent] id 1 len 10 *Jun 16 05:05:11.423: Vi2 IPCP: Address 150.1.1.1 (0x030696010101) *Jun 16 05:05:11.427: Vi2 LCP: I PROTREJ [Open] id 3 len 10 protocol CDPCP (0x820701010004) *Jun 16 05:05:11.427: Vi2 CDPCP: State is Closed *Jun 16 05:05:11.427: Vi2 CDPCP: State is Listen *Jun 16 05:05:11.427: Vi2 IPCP: I CONFNAK [ACKsent] id 1 len 10 *Jun 16 05:05:11.427: Vi2 IPCP: Address 150.1.1.100 (0x030696010164) *Jun 16 05:05:11.427: Vi2 IPCP: O CONFREQ [ACKsent] id 2 len 10 *Jun 16 05:05:11.431: Vi2 IPCP: Address 150.1.1.100 (0x030696010164) *Jun 16 05:05:11.431: Vi2 IPCP: I CONFACK [ACKsent] id 2 len 10 *Jun 16 05:05:11.431: Vi2 IPCP: Address 150.1.1.100 (0x030696010164) *Jun 16 05:05:11.431: Vi2 IPCP: State is Open *Jun 16 05:05:11.435: Di1 IPCP: Install negotiated IP interface address 150.1.1.100 *Jun 16 05:05:11.439: Di1 IPCP: Install default route thru 150.1.1.1 *Jun 16 05:05:11.439: Di1 IPCP: Install route to 150.1.1.1 *Jun 16 05:05:11.443: Vi2 IPCP: Add link info for cef entry 150.1.1.1 *Jun 16 05:05:12.419: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up |
To test or verify PPPoE operation, simply perform the same actions and instead enable PPPoE debugging on the router, for example:
| R4(config)#logging console R4(config)#interface dialer 1 R4(config-if)#shut *Jun 16 05:09:19.015: %DIALER-6-UNBIND: Interface Vi2 unbound from profile Di1 *Jun 16 05:09:19.015: Di1 DDR: dialer shutdown complete *Jun 16 05:09:19.047: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down *Jun 16 05:09:20.011: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to down *Jun 16 05:09:21.015: %LINK-5-CHANGED: Interface Dialer1, changed state to administratively down R4(config-if)#do debug pppoe events PPPoE protocol events debugging is on R4(config-if)#do debug pppoe packets PPPoE control packets debugging is on R4(config-if)#no shut R4(config-if)# *Jun 16 05:09:58.183: %LINK-3-UPDOWN: Interface Dialer1, changed state to up *Jun 16 05:09:59.511: Sending PADI: Interface = FastEthernet0/0 *Jun 16 05:09:59.511: pppoe_send_padi: FF FF FF FF FF FF 00 0F 23 5E F1 20 88 63 11 09 00 00 00 0C 01 01 00 00 01 03 00 04 85 06 8D 4C … *Jun 16 05:09:59.511: PPPoE 0: I PADO R:000f.235e.ec80 L:000f.235e.f120 Fa0/0 00 0F 23 5E F1 20 00 0F 23 5E EC 80 88 63 11 07 00 00 00 26 01 01 00 00 01 03 00 04 85 06 8D 4C … *Jun 16 05:10:01.559: PPPOE: we’ve got our pado and the pado timer went off *Jun 16 05:10:01.559: OUT PADR from PPPoE Session 00 0F 23 5E EC 80 00 0F 23 5E F1 20 88 63 11 19 00 00 00 26 01 01 00 00 01 03 00 04 85 06 8D 4C … *Jun 16 05:10:01.563: PPPoE 4: I PADS R:000f.235e.ec80 L:000f.235e.f120 Fa0/0 00 0F 23 5E F1 20 00 0F 23 5E EC 80 88 63 11 65 00 04 00 26 01 01 00 00 01 03 00 04 85 06 8D 4C … *Jun 16 05:10:01.563: IN PADS from PPPoE Session *Jun 16 05:10:01.567: %DIALER-6-BIND: Interface Vi2 bound to profile Di1 *Jun 16 05:10:01.567: PPPoE: Virtual Access interface obtained. *Jun 16 05:10:01.571: PPPoE : encap string prepared *Jun 16 05:10:01.571: [0]PPPoE 4: data path set to Virtual Acess *Jun 16 05:10:01.575: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up *Jun 16 05:10:02.575: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up |
Final Router Configurations
R1
|
R1#term len 0 Current configuration : 1433 bytes R1# |
R2
|
R2#term len 0 Current configuration : 968 bytes R2# |
R4
|
R4#term len 0 Current configuration : 1037 bytes R4# |