WAN HighLevel Data Link Control HDLC PPP PPP

大綱 • • • WAN 概述 High-Level Data Link Control (HDLC) PPP 綜述 PPP 認證 配置 PPP

序列通訊 • WAN 技術是基於在實體層的序列通訊 • 常見的訊號編碼法包括 Nonreturn to Zero Level (NRZ-L), High Density Binary 3 (HDB 3), 以及 Alternative Mark Inversion (AMI). • 通訊標準包括： – RS-232 -E – V. 35 – High Speed Serial Interface (HSSI，高速序列介面)

廣域網的服務提供 WAN service provider toll network S S S CO Switch S Trunks and switches Local Loop Demarcation Point-to-point or circuit-switched connection • 服務商給用戶分配線路的參數

PPP 的序列埠連接 Router connections End user device DTE DCE Service Provider EIA/TIA-232 EIA/TIA-449 V. 35 X. 21 EIA-530 Network connections at the CSU/DSU

廣域網連接類型: 資料連結層 專線 HDLC, PPP, SLIP X. 25, Frame Relay, ATM 電路交換 Service Provider PPP, SLIP, HDLC 封包交換 Telephone Company

HDLC的沿革 • 早期，序列通訊是基於以字元為主的協定，而位元為主的 協定 (Bit-oriented protocols)較具效率，但為專有的 • 在 1979年，ISO 同意 HDLC 為在同步序列鏈路上以位元 為主封裝資料的資料鏈結協定標準，導致其他委員會採用 並加以延伸。 • 從 1981 起，ITU-T 已經發展了一系列的 HDLC 衍生的協 定，以下是稱為鏈結存取協定 (link access protocols)的衍 生協定範例： – Link Access Procedure, Balanced (LAPB) for X. 25 – Link Access Procedure on the D channel (LAPD) for ISDN – Link Access Procedure for Modems (LAPM) and PPP for modems – Link Access Procedure for Frame Relay (LAPF) for Frame Relay

HDLC 訊框格式 Cisco HDLC Flag Address Control Proprietary Data FCS Flag • Cisco的 HDLC 具有proprietary 位元組提供對多協定環境的支援 HDLC Flag Address Control • 支援單一的協定環境 Data FCS Flag

HDLC 命令 Router(config-if)#encapsulation hdlc • 啟用HDLC封裝 • HDLC是同步序列埠的預設封裝格式

PPP 綜述 Multiple protocol encapsulations using NCPs in PPP TCP/IP Novell IPX Apple. Talk PPP Encapsulation Link setup and control using LCP in PPP • PPP 可以通過 NCP 攜帶多個協定的資料包 • PPP 可以通過 LCP 建立和控制連接

PPP 分層結構 IP IPX IPCP PPP IPXCP Layer 3 Protocols 許多其他者 Network Layer Network Control Protocol Authentication, 其他選項 Link Control Protocol Synchronous or Asynchronous Physical Media Data Link Layer Physical Layer • PPP—具有網路層服務之資料鏈結

PPP Protocol 欄位名稱 16進位值 協定名稱 8021 Internet Protocol Control Protocol 8023 OSI Network Layer Control Protocol 8029 Apple. Talk Control Protocol 802 b Novell IPX Control Protocol C 021 Link Control Protocol C 023 Password Authentication Protocol C 223 Challenge Handshake Authentication Protocol

LCP 的 Code 欄位 Code Packet Type Description 0116 Configurerequest Contains the list of proposed options and their values 0216 Configure-ack Accepts all options proposed 0316 Configure-nak Announces that some options are not acceptable 0416 Configure-reject Announces that some options are not recognized 0516 Terminaterequest Requests to shut down the line 0616 Terminate-ack Accepts the shut down request 0716 Code-reject Announces an unknown code 0816 Protocol-reject Announces an unknown protocol 0916 Echo-request A type of hello message to check if the other end is alive 0 A 16 Echo-reply The response to the echo-request message 0 B 16 Discard-request A request to discard the packet

PPP LCP 配置選項 Feature How It Operates 需一個密碼 認證 Authentication 執行 Challenge Handshake 壓縮 Compression 錯誤偵測 Error Detection 多鏈路 Multilink Protocol PAP CHAP 在來源壓縮資料; 在目的重生資料 Stacker 或 Predictor 監控鏈路上被丟失之資料 Magic Number 避免訊框迴路 跨多鏈路做負載平衡 (load balance) Multilink Protocol (MP)

PPP 封裝格式選項 • PPP 使用 LCP 自動協商封裝格式選項，例 如： – Authentication – Compression – Error detection – Multilink – PPP Callback

IPCP 封裝

IPCP 的 Code 欄位 Code IPCP Packet 01 Configure-request 02 Configure-ack 03 Configure-nak 04 Configure-reject 05 Terminate-request 06 Terminate-ack 07 Code-reject

選擇 PPP 認證協定 PAP 2 -Way Handshake Remote Router (Santa. Cruz) Central-Site Router (HQ) “santacruz, boardwalk” Accept/Reject Hostname: santacruz Password: boardwalk • 密碼明文傳輸 • 認證兩端是同等的 username santacruz password boardwalk

選擇 PPP 認證協定 Remote Router (Santa. Cruz) CHAP 3 -Way Handshake Central-Site Router (HQ) Challenge Response Hostname: santacruz Password: boardwalk Accept/Reject • 密碼是加密的 username santacruz password boardwalk

CHAP 封包

設定 PPP 認證總述 驗證您是誰 Service Provider Authenticating Router (收到呼叫的路由器. ) üppp encapsulation ühostname üusername / password üppp authentication Enabling PPP Authentication Router to Be Authenticated (發起呼叫的路由器. ) Enabling PPP üppp encapsulation ühostname üusername / password üppp authentication Enabling PPP Authentication

設定PPP • PPP 可配置在下列的實體介面上： – – 非同步序列 (Asynchronous serial) 同步序列(Synchronous serial) 高速序列介面(High-Speed Serial Interface, HSSI) 整合服務數位網 (Integrated Services Digital Network, ISDN) Router(config-if)#encapsulation ppp 啟動 PPP 認證

設定PPP 認證 Router(config)#hostname • 給路由器命名 Router(config)#username password • 提供需要認證的路由器的名稱和密碼

設定PPP 認證 Router(config-if)#ppp authentication {chap | chap pap | pap chap | pap} 啟動 PAP 或 CHAP 認證

PAP 配置舉例 Left router PSTN/ISDN hostname left username right password sameone ! int serial 0 ip address 10. 0. 1. 1 255. 0 encapsulation ppp authentication PAP ppp pap sent-username Left password someone Right router hostname right username left password sameone ! int serial 0 ip address 10. 0. 1. 2 255. 0 encapsulation ppp authentication PAP ppp pap sent-username Right password someone

CHAP 配置舉例 Left router PSTN/ISDN hostname left username right password sameone ! int serial 0 ip address 10. 0. 1. 1 255. 0 encapsulation ppp authentication CHAP Right router hostname right username left password sameone ! int serial 0 ip address 10. 0. 1. 2 255. 0 encapsulation ppp authentication CHAP

�看 HDLC 和 PPP 的封裝 Router#show interface s 0 Serial 0 is up, line protocol is up Hardware is HD 64570 Internet address is 10. 140. 1. 2/24 MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec, rely 255/255, load 1/255 Encapsulation PPP, loopback not set, keepalive set (10 sec) LCP Open: IPCP, CDPCP Last input 00: 00: 05, output hang never Last clearing of "show interface" counters never Queueing strategy: fifo Output queue 0/40, 0 drops; input queue 0/75, 0 drops 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 38021 packets input, 5656110 bytes, 0 no buffer Received 23488 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 38097 packets output, 2135697 bytes, 0 underruns 0 output errors, 0 collisions, 6045 interface resets 0 output buffer failures, 0 output buffers swapped out 482 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up

利用 debug ppp authentication 命令�看 PPP 認證 Left router • 4 d 20 h: • 4 d 20 h: • 4 d 20 h: changed Service Provider Right router %LINK-3 -UPDOWN: Interface Serial 0, changed state to up Se 0 PPP: Treating connection as a dedicated line Se 0 PPP: Phase is AUTHENTICATING, by both Se 0 CHAP: O CHALLENGE id 2 len 28 from ”left" Se 0 CHAP: I CHALLENGE id 3 len 28 from ”right" Se 0 CHAP: O RESPONSE id 3 len 28 from ”left" Se 0 CHAP: I RESPONSE id 2 len 28 from ”right" Se 0 CHAP: O SUCCESS id 2 len 4 Se 0 CHAP: I SUCCESS id 3 len 4 dialer Protocol up for Se 0 %LINEPROTO-5 -UPDOWN: Line protocol on Interface Serial 0, state to up

配置其他選項 • 配置壓縮選項 Router(config-if)# compress {stac | predictor} • 配置錯誤偵測品質 Router(config-if)# ppp quality <1 -100> • 配置多鏈路 Router(config-if)# ppp multilink

其他 debug ppp 選項 • • debug ppp packet debug ppp negotiation debug ppp error debug ppp chap