世界网络路由器技术路由器基础CISCO路由器配置手册

CISCO路由器配置手册

六、PSTN

  电话网络(PSTN)是目前普及程度最高、成本最低的公用通讯网络,它在网络互连中也有广泛的应用。电话网络的应用一般可分为两种类型,一种是同等级别机构之间以按需拨号(DDR)的方式实现互连,一种是ISP为拨号上网为用户提供的远程访问服务的功能。

1.     远程访问


1.1.Access Server基本设置:

选用Cisco2511作为访问服务器,采用IP地址池动态分配地址.远程工作站使用WIN95拨号网络实现连接。

全局设置:

任务

命令

设置用户名和密码

username username password password

设置用户的IP地址池

ip local pool {default | pool-name low-ip-address [high-ip-address]}

指定地址池的工作方式

ip address-pool [dhcp-proxy-client | local]

基本接口设置命令:

任务

命令

设置封装形式为PPP

encapsulation ppp

启动异步口的路由功能

async default routing

设置异步口的PPP工作方式

async mode {dedicated | interactive}

设置用户的IP地址

peer default ip address {ip-address | dhcp | pool [pool-name]}

设置IP地址与Ethernet0相同

ip unnumbered ethernet0

line拨号线设置:

任务

命令

设置modem的工作方式

modem {inout|dialin}

自动配置modem类型

modem autoconfig discovery

设置拨号线的通讯速率

speed speed

设置通讯线路的流控方式

flowcontrol {none | software [lock] [in | out] | hardware [in | out]}

连通后自动执行命令

autocommand command

访问服务器设置如下:

Router:

hostname Router

enable secret 5 $1$EFqU$tYLJLrynNUKzE4bx6fmH//

!

interface Ethernet0

ip address 10.111.4.20 255.255.255.0

!

interface Async1

ip unnumbered Ethernet0

encapsulation ppp

keepalive 10

async mode interactive

peer default ip address pool Cisco2511-Group-142

!

ip local pool Cisco2511-Group-142 10.111.4.21 10.111.4.36

!

line con 0

exec-timeout 0 0

password cisco

!

line 1 16

modem InOut

modem autoconfigure discovery

flowcontrol hardware

!

line aux 0

transport input all

line vty 0 4

password cisco

!

end  

相关调试命令

show interface

show line

1.2.       Access Server通过Tacacs服务器实现安全认证:

使用一台WINDOWS NT服务器作为Tacacs服务器,地址为10.111.4.2,运行Cisco2511随机带的Easy ACS 1.0软件实现用户认证功能.

相关设置:

任务

命令

激活AAA访问控制

aaa new-model

用户登录时默认起用Tacacs+做AAA认证

aaa authentication login default tacacs+

列表名为no_tacacs使用ENABLE口令做认证

aaa authentication login no_tacacs enable

在运行PPP的串行线上采用Tacacs+做认证

aaa authentication ppp default tacacs+

由TACACS+服务器授权运行EXEC

aaa authorization exec tacacs+

由TACACS+服务器授权与网络相关的服务请求。

aaa authorization network tacacs+

为EXEC会话运行记帐.进程开始和结束时发通告给TACACS+服务器。

aaa accounting exec start-stop tacacs+

为与网络相关的服务需求运行记帐包括SLIP,PPP,PPP NCPs,ARAP等.在进程开始和结束时发通告给TACACS+服务器。

aaa accounting network start-stop tacacs+

指定Tacacs服务器地址

tacacs-server host 10.111.4.2

在Tacacs+服务器和访问服务器设定共享的关键字,访问服务器和Tacacs+服务器使用这个关键字去加密口令和响应信息。这里使用tac作为关键字。

tacacs-server key tac

访问服务器设置如下:

hostname router

!

aaa new-model

aaa authentication login default tacacs+

aaa authentication login no_tacacs enable

aaa authentication ppp default tacacs+

aaa authorization exec tacacs+

aaa authorization network tacacs+

aaa accounting exec start-stop tacacs+

aaa accounting network start-stop tacacs+

enable secret 5 $1$kN4g$CvS4d2.rJzWntCnn/0hvE0

!

interface Ethernet0

 ip address 10.111.4.20 255.255.255.0

!

interface Serial0

no ip address

shutdown

interface Serial1

no ip address

shutdown

!

interface Group-Async1

ip unnumbered Ethernet0

encapsulation ppp

async mode interactive

peer default ip address pool Cisco2511-Group-142

no cdp enable

group-range 1 16

!

ip local pool Cisco2511-Group-142 10.111.4.21 10.111.4.36

tacacs-server host 10.111.4.2

tacacs-server key tac

!

line con 0

exec-timeout 0 0

password cisco

login authentication no_tacacs 

line 1 16

login authentication tacacs

modem InOut

modem autoconfigure type usr_courier

autocommand ppp

transport input all

stopbits 1

rxspeed 115200

txspeed 115200

flowcontrol hardware

line aux 0

transport input all

line vty 0 4

password cisco

!

end

2.      DDR(dial-on-demand routing)实例


此例通过Cisco 2500系列路由器的aux端口实现异步拨号DDR连接。Router1拨号连接到Router2。其中采用PPP/CHAP做安全认证,在Router1中应建立一个用户,以对端路由器主机名作为用户名,即用户名应为Router2。同时在Router2中应建立一个用户,以对端路由器主机名作为用户名,即用户名应为Router1。所建的这两用户的password必须相同。

相关命令如下:

任务

命令

设置路由器与modem的接口指令

chat-script script-name EXPECT SEND EXPECT SEND (etc.)

设置端口在挂断前的等待时间

dialer idle-timeout seconds

设置协议地址与电话号码的映射

dialer map protocol next-hop-address [name hostname] [broadcast] [modem-script

modem-regexp] [system-script system-regexp] [dial-string]

设置电话号码

dialer string dial-string

指定在特定线路下路由器默认 使用的chat-script

script {dialer|reset} script-name

Router1:

hostname Router1

!

enable secret 5 $1$QKI7$wXjpFqC74vDAyKBUMallw/

!

username Router2 password cisco

chat-script cisco-default  "" "AT" TIMEOUT 30 OK "ATDT \T" TIMEOUT 30 CONNECT \c

!

interface Ethernet0

ip address 10.0.0.1 255.255.255.0

!

interface Async1

ip address 192.200.10.1 255.255.255.0

encapsulation ppp

async default routing

async mode dedicated

dialer in-band

dialer idle-timeout 60

dialer map ip 192.200.10.2 name Router2 modem-script cisco-default 573

dialer-group 1

ppp authentication chap

!

ip route 10.0.1.0 255.255.255.0 192.200.10.2

dialer-list 1 protocol ip permit   

!

line con 0

line aux 0

modem InOut

modem autoconfigure discovery

flowcontrol hardware                                                                           


Router2:

hostname Router2

!

enable secret 5 $1$F6EV$5U8puzNt2/o9g.t56PXHo.

!

username Router1 password cisco

!

interface Ethernet0

ip address 10.0.1.1 255.255.255.0

!

interface Async1

ip address 192.200.10.2 255.255.255.0

encapsulation ppp

async default routing

async mode dedicated

dialer in-band

dialer idle-timeout 60

dialer map ip 192.200.10.1 name Router1

dialer-group 1

ppp authentication chap

!

ip route 10.0.0.0 255.255.255.0 192.200.10.1

dialer-list 1 protocol ip permit

!

line con 0

line aux 0

modem InOut

modem autoconfigure discovery

flowcontrol hardware

!

相关调试命令

debug dialer

debug ppp authentication

debug ppp error

debug ppp negotiation

debug ppp packet

show dialer    

3.        异步拨号备份DDN专线:


   此例主连接采用DDN专线,备份线路为电话拨号。当DDN专线连接正常时,主端口S0状态为up,line protocol亦为up,则备份线路状态为standby,line protocol为down,此时所有通信均通过主接口进行。当主接口连接发生故障时,端口状态为down,则激活备份接口,完成数据通信。此方法不适合为X.25做备份。因为,配置封装为X.25的接口只要和X.25交换机之间的连接正常其接口及line protocol的状态亦为 up,它并不考虑其它地方需与之通信的路由器的状态如何,所以若本地路由器状态正常,而对方路由器连接即使发生故障,本地也不会激活备份线路。例4将会描述如何为X.25做拨号备份。 


以下是相关命令:

任务

命令

指定主线路改变后,次线路状态发生改变的延迟时间

backup delay {enable-delay | never} {disable-delay | never}

指定一个接口作为备份接口

backup interface type number

hostname c2522rb

!

enable secret 5 $1$J5vn$ceYDe2FwPhrZi6qsIIz6g0

enable password cisco

!

username c4700 password 0 cisco

ip subnet-zero

chat-script cisco-default "" "AT" TIMEOUT 30 OK "ATDT \T" TIMEOUT 30 CONNECT \c

chat-script reset atz

!

interface Ethernet0

ip address 16.122.51.254 255.255.255.0

no ip mroute-cache

!

interface Serial0

backup delay 10 10

backup interface Serial2

ip address 16.250.123.18 255.255.255.252

no ip mroute-cache

no fair-queue

!

interface Serial1

no ip address

no ip mroute-cache

shutdown

!

interface Serial2

physical-layer async

ip address 16.249.123.18 255.255.255.252

encapsulation ppp

async mode dedicated

dialer in-band

dialer idle-timeout 60

dialer map ip 16.249.123.17 name c4700 6825179

dialer-group 1

ppp authentication chap

!

interface Serial3

no ip address

shutdown

no cdp enable

!

interface Serial4

no ip address

shutdown

no cdp enable

!

interface Serial5

no ip address

no ip mroute-cache

shutdown

!

interface Serial6

no ip address

no ip mroute-cache

shutdown

!

interface Serial7

no ip address

no ip mroute-cache

shutdown

!

interface Serial8

no ip address

no ip mroute-cache

shutdown

!

interface Serial9

no ip address

no ip mroute-cache

shutdown

!

interface BRI0

no ip address

no ip mroute-cache

shutdown

!

router eigrp 200

network 16.0.0.0

!

ip classless

!

dialer-list 1 protocol ip permit

!

line con 0

line 2

script dialer cisco-default

script reset reset

modem InOut

modem autoconfigure discovery

rxspeed 38400

txspeed 38400

flowcontrol hardware

line aux 0

line vty 0 4

password cisco

login

!

end

c2522rb#

4.       异步拨号备份X.25:


  
   设置X.25的拨号备份,首先X.25连接的端口必须运行动态路由协议,异步拨号口必须使用静态路由.本例选择EIGRP作为路由选择协议,将静态路由的Metric的值设置为200,由于EIGRP的默认Metric为90,所以当同时有两条路径通往同一网段时,其中Metric值小的路径生效,而当X.25连接出现问题时,路由器无法通过路由协议学习到路由表,则此时静态路由生效,访问通过拨号端口实现。当X.25连接恢复正常时,路由器又可以学习到路由表,则由于 Metric值的不同,静态路由自动被动态路由所代替,这样就实现了备份的功能。

路由器Router1配置如下:

hostname router1

!

enable secret 5 $1$UTvD$99YiY2XsRMxHudcYeHn.Y.

enable password cisco

!

username router2 password cisco

ip subnet-zero

chat-script cisco-default "" "AT" TIMEOUT 30 OK "ATDT \T" TIMEOUT 30 CONNECT \c

chat-script reset atz

interface Ethernet0

ip address 202.96.38.100 255.255.255.0

!

interface Serial0

ip address 202.96.0.1 255.255.255.0

encapsulation x25

x25 address 10112227

x25 htc 16

x25 map ip 202.96.0.2 10112225 broadcast

!

interface Serial1

no ip address

shutdown

!

!

interface Async 1

ip address 202.96.1.1 255.255.255.252

encapsulation ppp

dialer in-band

dialer idle-timeout 60

dialer map ip 202.96.1.2 name router2 modem-script cisco-default 2113470

dialer-group 1

ppp authentication chap

!

router eigrp 200

redistribute connected

network 202.96.0.0

!

ip route 202.96.37.0 255.255.255.0 202.96.1.2 200

dialer-list 1 protocol ip permit

line con 0

line aux 0

script dialer cisco-default

script reset reset

modem InOut

modem autoconfigure discovery

transport input all

rxspeed 38400

txspeed 38400

flowcontrol hardware

line vty 0 4

password cisco

login

!

end

路由器Router2配置如下:

hostname router2

!

enable secret 5 $1$T4IU$2cIqak8f/E4Ug6dLT0k.J0

enable password cisco

!

username router1 password cisco

ip subnet-zero

chat-script cisco-default "" "AT" TIMEOUT 30 OK "ATDT \T" TIMEOUT 30 CONNECT \c

chat-script reset atz

!

interface Ethernet0

ip address 202.96.37.100 255.255.255.0

!

interface Serial0

ip address 202.96.0.2 255.255.255.0

no ip mroute-cache

encapsulation x25

x25 address 10112225

x25 htc 16

x25 map ip 202.96.0.1 10112227 broadcast

!

interface Serial1

no ip address

shutdown

!

interface Async1

ip address 202.96.1.2 255.255.255.252

encapsulation ppp

keepalive 30

async default routing

async mode dedicated

dialer in-band

dialer idle-timeout 60

dialer wait-for-carrier-time 120

dialer map ip 202.96.1.1 name router1 modem-script cisco-default 2113469

dialer-group 1

ppp authentication chap

!

router eigrp 200

redistribute static

network 202.96.0.0

!

no ip classless

ip route 202.96.38.0 255.255.255.0 202.96.1.1 200

dialer-list 1 protocol ip permit

!

line con 0

exec-timeout 0 0

line aux 0

script reset reset

modem InOut

modem autoconfigure discovery

transport input all

rxspeed 38400

txspeed 38400

flowcontrol hardware

line vty 0 4

password cisco

login

!

end

返回目录


[关闭窗口]