IPv6串列鏈路上的PPP CHAP/PAP身份驗證配置示例

簡介

本檔案將提供點對點通訊協定(PPP)詢問交握驗證通訊協定(CHAP)/密碼驗證通訊協定(PAP)透過IPv6序列連結驗證的範例組態。

啟用PAP或CHAP時，本地路由器要求遠端裝置在允許資料流流動之前證明其身份。PAP身份驗證要求遠端裝置傳送名稱和密碼，並根據本地使用者名稱資料庫或遠端安全伺服器資料庫中的匹配條目檢查該名稱和密碼。CHAP身份驗證向遠端裝置傳送詢問消息。遠端裝置使用共用金鑰加密質詢值，並在響應消息中將加密值及其名稱返回給本地路由器。本地路由器會嘗試將遠端裝置的名稱與儲存在本地使用者名稱或遠端安全伺服器資料庫中的關聯金鑰相匹配。它使用儲存的金鑰加密原始質詢並驗證加密的值是否匹配。

必要條件

需求

嘗試此組態之前，請確保符合以下要求：

• 瞭解PAP/CHAP身份驗證過程

• 瞭解基本IPv6

採用元件

本文中的資訊係根據以下軟體和硬體版本：

• Cisco IOS軟體版本12.4，高級IP服務功能集

• Cisco 3700系列多重服務存取路由器

慣例

如需文件慣例的詳細資訊，請參閱思科技術提示慣例。

背景資訊

在示例中，路由器R1和R2配置了PPP身份驗證。在路由器R1中，介面S1/0啟用了IPv6，並通過實施EUI-64，具有IPv6地址2011:2706:ABC::/64 eui-64。擴展唯一識別符號(EUI)使主機能夠自動為自己分配唯一的64位IPv6介面識別符號，而無需手動配置或DHCP。在乙太網介面上，通過引用已經唯一的48位MAC地址，並重新格式化該值以匹配EUI-64規範，即可完成此操作。同樣，路由器R2上的S1/0介面也啟用了2011:2706:ABC::/64 eui-64。

設定

路由器R1和R2配置了基本PPP/CHAP身份驗證。

網路圖表

組態

本檔案會使用以下設定：

• R1配置

• R2配置

hostname R1
!
aaa new-model
!
aaa authentication ppp default local
!
username R2 password 0 cisco

interface Serial1/0
 no ip address
 encapsulation ppp
 ipv6 address 2011:2706:ABC::/64 eui-64
 ipv6 enable
 no fair-queue
 ppp authentication chap callin
!

interface Serial1/1
 no ip address
 encapsulation ppp
 ipv6 address 2011:2706:ABC::/64 eui-64
 ipv6 enable
 clock rate 64000
 ppp chap hostname R2
 ppp chap password 0 cisco

驗證

本節提供的資訊可用於確認您的組態是否正常運作。

在路由器R1上，發出以下命令：

1. debug ppp negotiation

   debug ppp negotiation
   
   
   *Jun 27 08:34:56:357: Se1/0 PPP: Outbound cdp packet dropped
   *Jun 27 08:34:56:845: %SYS-5-CONFIG_|: Configured from console by console
   *Jun 27 08:34:58:357: %LINK-3-UPDOWN: Interface Serial1/0, changed state to up
   *Jun 27 08:34:58:357: Se1/0 PPP: Using default call direction
   *Jun 27 08:34:58:357: Se1/0 PPP: Treating connection as a dedicated line
   *Jun 27 08:34:58:357: Se1/0 PPP: Session handle[470002F8] Session id[29]
   *Jun 27 08:34:58:357: Se1/0 PPP: Phase is ESTABLISHING, Active Open
   *Jun 27 08:34:58:357: Se1/0 LCP: O CONFREQ [Closed] id 72 len 15
   *Jun 27 08:34:58:357: Se1/0 LCP:  AuthProto CHAP (0x0305C22305)
   *Jun 27 08:34:58:357: Se1/0 LCP:  MagicNumber 0x35B44C0F (0x050635B44C0F)
   *Jun 27 08:34:58:361: Se1/0 LCP: I CONFREQ {REQsent] id 59 len 10
   *Jun 27 08:34:58:361: Se1/0 LCP:  MagicNumber 0x1FEDF9A2 (0x05061FEDF9A2)
   *Jun 27 08:34:58:361: Se1/0 LCP: O CONFACK {REQsent] id 59 len 10
   *Jun 27 08:34:58:361: Se1/0 LCP:  MagicNumber 0x1FEDF9A2 (0x05061FEDF9A2)
   *Jun 27 08:34:58:365: Se1/0 LCP: I CONFACK {ACKsent] id 72 len 15
   *Jun 27 08:34:58:365: Se1/0 LCP:  AuthProto CHAP (0x0305C22305)
   *Jun 27 08:34:58.365: Se1/0 LCP:    MagicNumber 0x35B44C0F (0x050635B44C0F)
   *Jun 27 08:34:58.365: Se1/0 LCP: State is Open
   *Jun 27 08:34:58.365: Se1/0 PPP: Phase is AUTHENTICATING, by this end
   *Jun 27 08:34:58.365: Se1/0 CHAP: O CHALLENGE id 5 len 23 from "R1"
   *Jun 27 08:34:58.377: Se1/0 CHAP: I RESPONSE id 5 len 23 from "R2"
   *Jun 27 08:34:58.377: Se1/0 PPP: Phase is FORWARDING, Attempting Forward
   *Jun 27 08:34:58.377: Se1/0 PPP: Phase is AUTHENTICATING, Unauthenticated User
   *Jun 27 08:34:58.381: Se1/0 PPP: Phase is FORWARDING, Attempting Forward
   *Jun 27 08:34:58.381: Se1/0 PPP: Phase is AUTHENTICATING, Authenticated User
   *Jun 27 08:34:58.381: Se1/0 CHAP: O SUCCESS id 5 len 4
   *Jun 27 08:34:58.381: Se1/0 PPP: Phase is UP
   *Jun 27 08:34:58.381: Se1/0 CDPCP: O CONFREQ [Closed] id 1 len 4
   *Jun 27 08:34:58.381: Se1/0 IPV6CP: O CONFREQ [Closed] id 1 len 14
   *Jun 27 08:34:58.381: Se1/0 IPV6CP:    Interface-Id 021B:54FF:FEA9:24B0 
       (0x010A021B54FFFEA924B0)
   *Jun 27 08:34:58.381: Se1/0 PPP: Process pending ncp packets
   *Jun 27 08:34:58.389: Se1/0 CDPCP: I CONFREQ [REQsent] id 1 len 4
   *Jun 27 08:34:58.389: Se1/0 CDPCP: O CONFACK [REQsent] id 1 len 4
   *Jun 27 08:34:58.389: Se1/0 IPV6CP: I CONFREQ [REQsent] id 1 len 14
   *Jun 27 08:34:58.389: Se1/0 IPV6CP:    Interface-Id 021F:CAFF:FE04:F918 
       (0x010A021FCAFFFE04F918)
   *Jun 27 08:34:58.389: Se1/0 IPV6CP: O CONFACK [REQsent] id 1 len 14
   *Jun 27 08:34:58.389: Se1/0 IPV6CP:    Interface-Id 021F:CAFF:FE04:F918 
       (0x010A021FCAFFFE04F918)
   *Jun 27 08:34:58.393: Se1/0 CDPCP: I CONFACK [ACKsent] id 1 len 4
   *Jun 27 08:34:58.393: Se1/0 CDPCP: State is Open
   *Jun 27 08:34:58.393: Se1/0 IPV6CP: I CONFACK [ACKsent] id 1 len 14
   *Jun 27 08:34:58.393: Se1/0 IPV6CP:    Interface-Id 021B:54FF:FEA9:24B0 
       (0x010A021B54FFFEA924B0)
   *Jun 27 08:34:58.393: Se1/0 IPV6CP: State is Open
   *Jun 27 08:34:59.381: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0,
       changed state to up
   

2. debug ppp authentication

   *Jun 27 08:37:46.045: Se1/0 PPP: Using default call direction
   *Jun 27 08:37:46.045: Se1/0 PPP: Treating connection as a dedicated line
   *Jun 27 08:37:46.045: Se1/0 PPP: Session handle[C40002F9] Session id[30]
   *Jun 27 08:37:46.045: Se1/0 PPP: Authorization NOT required
   *Jun 27 08:37:46.053: Se1/0 CHAP: O CHALLENGE id 6 len 23 from "R1"
   *Jun 27 08:37:46.065: Se1/0 CHAP: I RESPONSE id 6 len 23 from "R2"
   *Jun 27 08:37:46.065: Se1/0 PPP: Sent CHAP LOGIN Request
   *Jun 27 08:37:46.065: Se1/0 PPP: Received LOGIN Response PASS
   *Jun 27 08:37:46.069: Se1/0 CHAP: O SUCCESS id 6 len 4
   
   

在路由器R2上，發出以下命令：

• debug ppp authentication

  debug ppp authentication 
  
  *Feb 28 05:18:39.439: Se1/1 PPP: Using default call direction
  *Feb 28 05:18:39.439: Se1/1 PPP: Treating connection as a dedicated line
  *Feb 28 05:18:39.439: Se1/1 PPP: Session handle[E300000B] Session id[35]
  *Feb 28 05:18:39.439: Se1/1 PPP: Authorization required
  *Feb 28 05:18:39.451: Se1/1 PPP: No authorization without authentication
  *Feb 28 05:18:39.455: Se1/1 CHAP: I CHALLENGE id 7 len 23 from "R1"
  *Feb 28 05:18:39.459: Se1/1 CHAP: Using hostname from interface CHAP
  *Feb 28 05:18:39.459: Se1/1 CHAP: Using password from interface CHAP
  *Feb 28 05:18:39.459: Se1/1 CHAP: O RESPONSE id 7 len 23 from "R2"
  *Feb 28 05:18:39.467: Se1/1 CHAP: I SUCCESS id 7 len 4
  

相關資訊

• IP第6版支援頁面
• 實施IPv6編址和基本連線
• IP 路由支援頁面
• 技術支援與文件 - Cisco Systems