PPP认证

华为PPP认证配置PPP协议点到点协议（Point to Point Protocol，PPP）是为在同等之间传输这样的简单链路设计的协议。

[1] 这种链路提供全双⼯操作，并按照顺序传递数据包。

设计⽬的主要是⽤来通过拨号或专线⽅式建⽴点对点连接发送数据，使其成为各种主机、⽹桥和之间简单连接的⼀种共通的解决⽅案。

PPP具有以下功能：（1）PPP具有动态分配地址的能⼒，允许在连接时刻协商IP地址；（2）PPP⽀持多种，⽐如、、等；（3）PPP具有错误检测能⼒，但不具备纠错能⼒，所以ppp是不可靠传输协议；（4）⽆重传的机制，⽹络开销⼩，速度快。

（5）PPP具有功能。

（6） PPP可以⽤于多种类型的物理介质上，包括串⼝线、电话线、移动电话和光纤（例如SDH），PPP也⽤于Internet接⼊。

华为路由器PPP配置命令：[huawei]interface s1/0/0进⼊串⾏接⼝[huawei-Serial1/0/0]link-protocol ppp设置接⼝模式为PPP，华为设备默认为PPP模式[huawei-Serial1/0/0]ip address 10.10.10.1 32配置IP地址[huawei-Serial1/0/0]ip address unnumbered interface loopback 1PPP模式接⼝也可以配置地址借⽤华为路由器PPP（pap）认证配置命令：让证端配置：[Huawei]aaa进⼊认证端的AAA配置[Huawei-aaa]local-user guest password cipher 123456增加被认证端的⽤户名及密码[Huawei-aaa]local-user guest service-type ppp配置此⽤户的服务类型为PPP[huawei-Serial1/0/0]ppp authentication-mode pap配置认证端的PPP认证模式为pap[huawei-Serial1/0/0]ip address 10.10.10.1 30配置认证端接⼝的IP地址被认证端配置：[huawei-Serial1/0/0]ppp pap local-user guest password cipher 123456配置被认证端的PPP认证⽤户名及密码[huawei-Serial1/0/0]ip address 10.11.11.1 30配置被认证端接⼝的IP地址查看serial端⼝的状态：[huawei-Serial1/0/0]display interface serial 1/0/0Serial1/0/0 current state : UPLine protocol current state : UPLast line protocol up time : 2021-03-17 17:40:33 UTC-08:00Description:HUAWEI, AR Series, Serial1/0/0 InterfaceRoute Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)Internet protocol processing : disabledLink layer protocol is PPPLCP opened两端配置正确之后，LCP为显⽰为Opened注：PPP的认证所需要的⽤户名及密码保存在认证端的AAA认证⾥⾯，被认证端所配置的⽤户名及密码必须与认证端的AAA⼀致配置PPP之后，需要将端⼝shutdown，再重新开启⼀下才可⽣效华为路由器PPP（chap）认证配置命令：认证端配置：1. 先配置认证端的AAA⽤户名及密码2. 然后配置AAA⽤户的服务类型为PPP[Huawei]interface Serial 1/0/0进⼊认证端的串⼝[Huawei-Serial1/0/0]ppp authentication-mode chap配置认证端的接⼝认证模式为chap被认证端配置：[Huawei-Serial1/0/0]ppp chap user guest配置被认证端接⼝chap认证⽅式的⽤户名[Huawei-Serial1/0/0]ppp chap password cipher 123456配置被认证端接⼝chap认证⽅式的密码查看配置：[Huawei-Serial1/0/0]display interface Serial 1/0/0注：被认证端的chap认证⽅式的⽤户名及密码需要分开配置，pap认证⽅式的⽤户名及密码可以⽤⼀条命令配置华为路由器PPP动态地址获取配置命令：被认证端配置：[Huawei-Serial1/0/0]ip address ppp-negotiate在被认证端端⼝下配置 IP地址⾃动协商认证端配置：[Huawei-Serial1/0/0]remote address 10.10.11.1在认证端接⼝下配置对端的IP地址查看配置：[Huawei-Serial1/0/0]display interface Serial 1/0/0Serial1/0/0 current state : UPLine protocol current state : UPLast line protocol up time : 2021-03-17 18:25:37 UTC-08:00Description:HUAWEI, AR Series, Serial1/0/0 InterfaceRoute Port,The Maximum Transmit Unit is 1500, Hold timer is 10(sec)Internet Address is 10.10.10.1/30Link layer protocol is PPPLCP opened, IPCP opened两端的链路协商完成后 LCP 显⽰opened，然后再协商IPCP ，IPCP成功协商显⽰ openedPPP动态地址获取——地址池pool配置：被认证端配置：[Huawei-Serial1/0/0]ip address ppp-negotiate在被认证端端⼝下配置 IP地址⾃动协商认证端配置：[Huawei-ip-pool-guest]认证端创建⼀个地址池ip pool guestgateway-list 10.10.10.1network 10.10.10.0 mask 255.255.255.0excluded-ip-address 10.10.10.10 10.10.10.254dns-list 114.114.114.114并配置⽤于给对端提供地址的⽹关、dns等[Huawei-Serial1/0/0]remote address pool guest在认证端的串⼝下启⽤地址池guest被认证端查看配置：[Huawei]display ip interface briefInterface IP Address/Mask Physical ProtocolGigabitEthernet0/0/0 unassigned down downGigabitEthernet0/0/1 192.168.10.1/24 up upGigabitEthernet0/0/2 192.168.20.1/24 up up NULL0 unassigned up up(s) Serial1/0/0 10.10.10.9/32 up up Serial1/0/1 unassigned down down 已经获取到了⼀个 10.10.10.9/32地址。

PPP资格证书体系指南© 2017 International Bank for Reconstruction and Development/The World BankSome rights reservedThis work was originally published by The World Bank Group in English as The APMG PPP Certification Guide in 2016. In case of any discrepancies, the original language will govern.The APMG PPP Certification Guide, referred to here as the PPP Guide, is the Book of Knowledge (BoK) detailing all relevant aspects of creating and implementing efficient, sustainable public-private partnerships (PPPs). It is intended for use by PPP professionals, governments, advisors, investors, and others with an interest in PPPs. The PPP Guide is part of the family of CP3P credentials that, once obtained, allow individuals to use the title “Certified PPP Professional,” a designation created under the auspices of the APMG PPP Certification Program. The APMG PPP Certification Program, referred to here as the Certification Program, is a product of the Asian Development Bank (ADB), the European Bank for Reconstruction and Development (EBRD), the Inter-American Development Bank (IDB), the Islamic Development Bank (IsDB), and the World Bank Group (WBG) part-funded by the Public-Private Infrastructure Advisory Facility (PPIAF).“The World Bank Group” refers to the legally separate organizations of the International Bank for Reconstruction and Development (IBRD), the International Development Association (IDA), the International Finance Corporation (IFC), and the Multilateral Investment Guarantee Agency (MIGA). Public-Private Infrastructure Advisory Facility (PPIAF) is a multi-donor technical assistance facility legally administered by the International Bank for Reconstruction and Development (IBRD). DISCLAIMERThe opinions, interpretations, findings, and/or conclusions expressed in this work are those of the authors and do not necessarily reflect the views or the official policies or positions of the ADB, EBRD, IDB, IsDB, PPIAF and WBG, their Boards of Directors, or the governments they represent. The above referenced organizations do not make any warranty, express or implied, nor assume any liability or responsibility for the accuracy, timeliness, correctness, completeness, merchantability, or fitness for a particular purpose of any information that is available herein.This publication follows the WBG’s practice in references to member designations and maps. The designation of or reference to a particular territory or geographic area, or the use of the term “country” in this document, do not imply the expression of any opinion whatsoever on the part of the above referenced organizations or their Boards of Directors, or the governments they represent concerning the legal status of any country, territory, city or area, or of its authorities, or concerning the delimitation of1its frontiers or boundaries.Nothing herein shall constitute or be considered to be a limitation upon or waiver of the privileges and immunities of any of The World Bank Group organizations, all of which are specifically reserved.RIGHTS AND PERMISSIONSThis work is available under the Creative Commons Attribution 3.0 IGO license (CC BY 3.0 IGO) /licenses/by/3.0/igo. Under the Creative Commons Attribution license, you are free to copy, distribute, transmit, and adapt this work, including for commercial purposes, under the following conditions:Attribution—Please cite the work as follows: World Bank. 2017. The APMG Public-Private Partnership (PPP) Certification Guide. Washington, DC: World Bank. License: Creative Commons Attribution CC BY 3.0 IGOTranslations—If you create a translation of this work, please add the following disclaimer along with the attribution: This translation was not created by ADB, EBRD, IDB, IsDB, and/or WBG and should not be considered an official translation. The organizations listed above shall not be liable for any content or error in this translation.Adaptations—If you create an adaptation of this work, please add the following disclaimer along with the attribution: This is an adaptation of an original work by ADB, EBRD, IDB, IsDB, and WBG. Views and opinions expressed in the adaptation are the sole responsibility of the author or authors of the adaptation and are not endorsed by the above organizations.Third-party content— ADB, EBRD, IDB, IsDB, and/or WBG do not necessarily own each component of the content contained within the work. These organizations therefore do not warrant that the use of any third-party-owned individual component or part contained in the work will not infringe on the rights of those third parties. The risk of claims resulting from such infringement rests solely with you. If you wish to re-use a component of the work, it is your responsibility to determine whether permission is needed for that re-use and to obtain permission from the copyright owner. Examples of components can include, but are not limited to, tables, figures, or images.All queries on rights and licenses should be addressed to World Bank Publications, The World Bank Group, 1818 H Street NW, Washington, DC 20433, USA; e-mail: ***********************.2© 2017国际复兴开发银行/世界银行部分版权所有本指南最初由世界银行集团于2016年出版《The APMG PPP Certification Guide》英文版。

PPP的CHAP认证和PAP认证Chap 和pap 认证有很多种，有单项的，有双向的。

单项chap认证。

(R1作为服务器端)R1(config)#interface s4/0R1(config-if)#ip address 192.168.1.1 255.255.255.0R1(config-if)#encapsulation ppp \\封装PPP协议R1(config-if)#ppp authentication chap \\开启认证，认证方式为chap认证R1(config-if)#exitR1(config)#username R2 password 0 123456 \\创建用户R2 ，用于识别认证客户端R2(config)#interface s4/0R2(config-if)#ip address 192.168.1.2 255.255.255.0R2(config-if)#encapsulation ppp \\封装PPP协议R2(config-if)#exitR2(config)#username R1 password 0 123456 \\创建用户R1，用于识别想服务器端单项pap 认证。

（R1作为服务器端）R1(config)#interface s4/0R1(config-if)#ip address 192.168.1.1 255.255.255.0R1(config-if)#encapsulation ppp \\封装PPP协议R1(config-if)#ppp authentication pap \\开启认证，认证方式为pap (服务器断开启)R1(config-if)#exitR1(config)#username R2 password 0 123456 \\创建的用户为客户端的主机名R2(config)#interface s4/0R2(config-if)#ip address 192.168.1.2 255.255.255.0R2(config-if)#encapsulation pppR2(config-if)#ppp pap sent-username R2 password 0 123456 \\定义客户端所要发送的用户名和密码，一般是发送跟自己主机名一样的的用户。

PPP 的PAP 认证实验名称：PPP PAP 认证。

实验目的：掌握PPP PAP 认证的过程及配置 。

技术原理：PPP 协议是目前使用最广泛的广域网协议，这是因为它具有以下特性：➢ 能够控制数据链路的建立；➢ 能够对IP 地址进行分配和使用；➢ 允许同时采用多种网络层协议（tcp/ip 、ipx/spx ）；➢ 能够配置和测试数据链路；➢ 能够进行错误检测；➢ 有协商选项，能够对网络层的地址和数据压缩等进行协商。

➢ 具有验证协议CHAP 、PAPPPP 协议结构：➢ NCP(网络控制协议)➢ LCP(连接控制协议)PAP 验证特点：➢ 两次握手协议➢ 明文方式进行验证 PAP 验证过程： 实现功能：在链路协商时保证安全验证。

实验设备：R2600路由器两台，V.35线缆一根。

实验拓朴：Client Server Hostname: RAPassword: star用户名+密码 验证成功验证失败 Username: RApassword :starRB RA实验步骤：1. 基本配置。

Router(config)#hostname raRa(config)#interface serial 1/2Ra(config-if)ip address 1.1.1.1 255.255.255.0Ra(config-if)no shutdownRouter(config)#hostname rbRb(config)#interface serial 1/2Rb(config-if)ip address 1.1.1.2 255.255.255.0Rb(config-if)clock rate 64000Rb(config-if)no shutdownRa#show interface serial 1/2serial 1/2 is DOWN , line protocol is DOWNHardware is PQ2 SCC HDLC CONTROLLER serialInterface address is: 1.1.1.1/24MTU 1500 bytes, BW 2000 KbitEncapsulation protocol is HDLC, loopback not setKeepalive interval is 10 sec , setCarrier delay is 2 secRXload is 1 ,Txload is 1Queueing strategy: WFQ5 minutes input rate 0 bits/sec, 0 packets/sec5 minutes output rate 0 bits/sec, 0 packets/sec0 packets input, 0 bytes, 0 res lack, 0 no buffer,0 dropped Received 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 abort0 packets output, 0 bytes, 0 underruns,0 dropped0 output errors, 0 collisions, 2 interface resets0 carrier transitionsNo cableDCD=down DSR=down DTR=down RTS=down CTS=downRb#show interface serial 1/2serial 1/2 is DOWN , line protocol is DOWNHardware is PQ2 SCC HDLC CONTROLLER serialInterface address is: 1.1.1.2/24 MTU 1500 bytes, BW 2000 KbitSerial 1/2Serial 1/2 验证端 被验证端RARBEncapsulation protocol is HDLC, loopback not setKeepalive interval is 10 sec , setCarrier delay is 2 secRXload is 1 ,Txload is 1Queueing strategy: WFQ5 minutes input rate 0 bits/sec, 0 packets/sec5 minutes output rate 0 bits/sec, 0 packets/sec0 packets input, 0 bytes, 0 res lack, 0 no buffer,0 droppedReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 abort0 packets output, 0 bytes, 0 underruns,0 dropped0 output errors, 0 collisions, 2 interface resets0 carrier transitionsNo cableDCD=down DSR=down DTR=down RTS=down CTS=down2．配置PPP 、PAP认证。

PPP与PPPoE协议的认证与拨号过程详解PPP协议（Point-to-Point Protocol）和PPPoE协议（Point-to-Point Protocol over Ethernet）是在计算机网络中常用的两个协议，它们在进行认证与拨号过程中扮演着重要的角色。

本文将详细介绍PPP与PPPoE协议的认证与拨号过程。

一、PPP协议的认证与拨号过程1. PPP认证过程在PPP协议中，认证过程被用于验证用户的身份信息，以确保连接的安全性。

认证过程一般包括以下几个步骤：（1）LCP配置阶段：建立连接前，对LCP（Link Control Protocol）进行配置，双方协商认证方式。

（2）身份验证阶段：发送端向接收端发送认证请求，并携带认证方式和认证信息。

接收端根据认证方式进行验证，如果通过则发送认证成功的消息，否则发送认证失败的消息。

（3）连接建立阶段：如果认证成功，双方继续进行连接建立的过程，启动NCP（Network Control Protocol）协商网络层协议参数。

2. PPP拨号过程PPP拨号过程用于建立网络连接。

具体步骤如下：（1）发起拨号：客户端向服务端发送拨号请求。

（2）应答拨号：服务端接收到拨号请求后，返回应答消息，表示可以建立连接。

（3）链路建立：双方进行链路的建立，包括配置参数、交换链路相关信息等。

（4）数据传输：链路建立完成后，进行数据的传输。

二、PPPoE协议的认证与拨号过程1. PPPoE认证过程PPPoE协议是在以太网上运行的一种PPP协议。

其认证过程也是通过PPP进行的，主要包括以下步骤：（1）PADI（PPPoE Active Discovery Initiation）：客户端在以太网上广播PADI包，该包包含客户端的MAC地址等信息。

（2）PADO（PPPoE Active Discovery Offer）：服务端收到PADI 包后，返回PADO包，该包中包含了服务端的MAC地址、会话ID等信息。

StatusofthisMemoThisdocumentspecifiesanInternetstandardstrackprotocolfortheInternetcommunity,andrequestsdiscussionandsuggestionsforimprovements.Pleaserefertothecurrenteditionofthe"InternetOfficialProtocolStandards"(STD1)forthestandardizationstateandstatusofthisprotocol.Distributionofthismemoisunlimited.CopyrightNoticeCopyright(C)TheInternetSociety(1998).AllRightsReserved.摘要点到点协议（PPP）提供一种在点到点链路上传输多协议报文的标准方法。

在PPP中定义了一个可扩展的链路控制协议（LCP），LCP协议允许协商认证协议，从而可以在网络层报文在链路上传输之前对对端进行认证。

本文档定义了PPP扩展认证协议（EAP）。

目录1介绍31.1要求规范31.2术语32PPP扩展认证协议(EAP)32.1配置选项(ConfigOption)格式42.2报文格式4请求和应答5成功和失败63EAP请求/应答类型73.1标识Identification73.2通知Notification83.3否定Nak83.4MD5挑战字83.5一次密码（OTP）93.6通用令牌卡94安全考虑95参考文献106鸣谢101.介绍为了在点到点的链路上进行通信，PPP链路的每一端在链路建立阶段必须首先发送LCP报文配置数据链路。

链路建立之后，PPP提供可选的认证阶段，可以在进入NCP阶段之前对对端进行认证。

缺省情况下，认证过程不是必须的。

如果需要链路认证，PPP实现必须在链路建立阶段指定“认证协议”配置选项。

p p p认证方式a p c h a p认证文件排版存档编号：[UYTR-OUPT28-KBNTL98-UYNN208]cisco ppp认证方式（pap、chap认证）一、实验拓扑二、实验要求：1、要求配置ppp协议2、分别用pap、chap认证3、配置总部的路由器给分部的路由器分配ip地址，并且从地址池中分配，4、pc1最终能ping铜pc2三、实验步骤：1、配置各路由器接口的ip地址如图---2、封装ppp协议R1(config)#interface s1/0R1(config-if)#encapsulation pppR1(config-if)#clock rate 64000R1(config-if)#ip addressR1(config-if)#no shutR2(config)#interface s1/0R2(config-if)#encapsulation pppR2（config-if）#no shutR2(config-if)#clock rate 64000 配置DCE端时钟频率3、配置IP地址池协商，并从地址池中获取R1(config)#interface s1/0R1(config-if)#peer default ip address pool aaaR1(config-if)#ip local pool aaaR2(config)#interface s1/0R2(config-if)#ip address negotiated?查看?s1/0接口的地址R2#show interface s1/0Serial1/0 is up, line protocol is upHardware is M4TInternet address is /32 如果获取不到地址将接 shutdown 然后再no shudownMTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,reliability 255/255, txload 1/255, rxload 1/255Encapsulation PPP, LCP OpenOpen: CDPCP, IPCP, crc 16, loopback not setKeepalive set (10 sec)4、启用rip协议并查看路由表R1(config)#router ripR1(config-router)#networkR1(config-router)#network查看路由表R1#show ip routeCodes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter ar N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-I ia - IS-IS inter area, * - candidate default, U - per-user s o - ODR, P - periodic downloaded static routeGateway of last resort is not setC /24 is directly connected, FastEthernet0/0/24 is variably subnetted, 2 subnets, 2 masksC/32 is directly connected, Serial1/0C/24 is directly connected, Serial1/0R/24 [120/1] via , 00:00:47, Serial1/0R2(config)#router ripR2(config-router)#networkR2(config-router)#networkR2(config-router)#exit?查看路由表?R2#show ip routeCodes: C - connected, S - static, R - RIP, M - mobile, B - BG D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inN1 - OSPF NSSA external type 1, N2 - OSPF NSSA externaE1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2ia - IS-IS inter area, * - candidate default, U - per-o - ODR, P - periodic downloaded static routeGateway of last resort is not set/32 is subnetted, 2 subnetsCis directly connected, Serial1/0Cis directly connected, Serial1/0C/24 is directly connected, FastEthernet0/05、配置PAP认证R1(config)#username abc password 0 123R1(config)#interface s1/0R1(config-if)#ppp authentication papR2(config)#interface s1/0R2(config-if)#ppp pap sentR2(config-if)#ppp pap sent-username abc password 0 123查看show runinterface Serial1/0ip address negotiatedencapsulation pppserial restart-delay 0clockrate 64000ppp pap sent-username abc password 0 1236、配置chap认证R1(config)#username abc password 0 123 以对方的主机名作为用户名，密码要和对方的路由器一致R1(config)#interface s1/0R1(config-if)#ppp authentication papR1(config-if)#exitR1(config)#username R2 password 0 123R1(config)#interface s1/0R1(config-if)#encapsulation pppR1(config-if)#ppp authentication chap chap 认证R2(config)#username R1 password 0 123 R2(config)#interface s1/0R2(config-if)#encapsulation pppR2#debug pppauthenticationPPP authentication debugging is on验证chap过程?7、 show run查看验证?8、测试结果 pc1 ping通pc2。

什么是PPP？PPP的认证方式又有哪些？展开全文点到点链路层协议PPP（PPPoE）主要用于在全双工的同异步链路上进行点到点的数据传输，PPP是一款公有标准协议，兼容性好。

PPP协议的特点：1、PPP支持在全双工的同异步链路上进行点到点的数据传输。

2、PPP具有很好的扩展性；PPPoE就是承载在以太网链路上的PPP协议。

3、PPP支持地址信息的自动协商；LCP协议用于各种链路层参数的协商；NCP协议用于各网络层参数的协商，更好地支持了网络层协议（peer neighbor-route）。

4、PPP支持PAP、CHAP认证（可以基于接口的密码认证；也可以基于本地数据库AAA认证，提供认证、授权和审计），更好的保证了网络的安全性。

5、PPP支持将多根链路进行捆绑（Multilink）；支持对所有类型的报文/报头进行压缩；无重传机制，网络开销小，速度快。

PPP协议的组成：协议伞步骤一：链路控制协议LCP；用来建立、拆除和监控PPP数据链路步骤二：认证协议；PAP（密码认证协议）和CHAP（挑战握手认证协议）；用于链路认证，支持单向认证和双向认证。

步骤三：网络层控制协议NCP（协议伞）；用于对不同的网络层协议进行连接建立和参数协商；协议包含了IPV4CP（IPCP）、IPV6CP、IPXCP等。

PPP链路的建立过程：1、Dead阶段也称为物理层不可用阶段。

当通信双方的两端检测到物理线路激活时，就会从Dead阶段迁移至Establish阶段，即链路建立阶段。

2、Establish阶段，PPP链路会进行LCP参数协商。

协商内容包括最大接收单元MRU、认证方式、魔术字（Magic Number）等选项。

LCP参数协商成功后会进入Opened状态，表示底层链路已经建立。

3、多数情况下,链路两端的设备是需要经过认证阶段（Authenticate）后才能够进入到网络层协议协商阶段。

PPP链路在缺省情况下是不要求进行认证的。