Huawei experiment ppp certification

Keywords: network http

Experimental principle

The reason why PPP protocol has become a more extensive protocol in Wan is that it provides CHAP,PAP and other verification protocols to better ensure the security of the network
PAP is two handshake authentication. The user name and secret are repeatedly sent to the authenticator on the link until the authentication passes or the connection is terminated. PAP is not a secure authentication protocol because the password is sent in clear text
CHAP is a three-time handshake. It only transmits the user name on the link and does not transmit the secret. Therefore, its security is higher than that of PAP. After the link is established, the verifier sends a "challenge" message to the verified party. The verified party passes through the hash algorithm once and returns a value to the verifier. The verifier compares its own hash algorithm with the value returned by the verified party. If the two match, Then the verification passes, otherwise the verification fails and the connection is terminated

Experimental purpose

Understand the authentication method of PPP PAP
Understand CHAP authentication methods
Understand the difference between PPAP authentication and CHAP authentication

Experimental topology

Experimental steps

1. Basic configuration, test connectivity
2. Build ospf network

[R1]ospf 1
[R1-ospf-1]area 0
[R2]ospf 1
[R2-ospf-1]area 0
[R3]ospf 1
[R3-ospf-1]area 0

At this time, pc1 and pc2 can communicate
3. Configure PAP authentication of PPP
R3 is an authenticated router and R1 is an authenticated router

#The authentication method is PAP and the authentication domain name is huawei
[R3]int s4/0/0
[R3-Serial4/0/0]ppp authentication-mode pap domain huawei
#Execute aaa and enter aaa view
#Create authentication scheme huawei_1, and enter the authentication view
[R3-aaa]authentication-scheme huawei_1
Info: Create a new authentication scheme.
#Configure the authentication mode as local authentication	
[R3-aaa-authen-huawei_1]authentication-mode local
#Create the domain as Huawei and enter the domain view
[R3-aaa]domain huaweiyu
Info: Success to create a new domain.	
#The authentication scheme of the configuration domain is huawei_1. This should be consistent with the one created earlier
[R3-aaa-domain-huaweiyu]authorization-scheme huawei_1
#Return to the aaa view and configure the user name and password for peer authentication
[R3-aaa]local-user R1@huaweiyu password cipher Huawei
Info: Add a new user.
[R3-aaa]local-user R1@huaweiyu service-type ppp
#Close the connection interfaces of R3 and R1, then reconnect and negotiate to check the link status and connectivity
[R3]int s4/0/0
[R3-Serial4/0/0]undo shutdown 

At this time, R1 and R3 cannot communicate, and authentication needs to be configured on the connected interface of R1

[R1]int s4/0/0. 
[R1-Serial4/0/0]ppp pap local-user R1@huaweiyu password cipher Huawei

At this time, it has been up

Test the connectivity of pc1 and pc2

4. Configure ppp chap authentication
PPP can easily obtain user name and password by capturing packets
Delete the original PAP authentication and keep the domain name unchanged

[R3]int s4/0/0
[R3-Serial4/0/0]undo ppp authentication-mode 
[R1]int s4/0/0
[R1-Serial4/0/0]undo ppp pap local-user

After deletion, configure the authentication mode of ppp under the s4/0/0 interface of the authentication device R3 as chap

[R3]int s4/0/0
[R3-Serial4/0/0]undo ppp authentication-mode 
[R3-Serial4/0/0]ppp authentication-mode CHAP

#The configuration is stored locally. The user name used for peer authentication is R1 and the password is huawei. Other configurations remain unchanged

[R3-aaa]local-user R1 password cipher huawei
Info: Add a new user.
[R3-aaa]local-user R1 service-type ppp

After configuration, close the interfaces of R1 and R3 for a period of time and then open them

[R3]int s4/0/0
[R3-Serial4/0/0]undo shutdown 

At this time, the protocol status of R1 and R3 is abnormal and cannot communicate, because the corresponding user name and password have not been configured on R1

[R1]int s4/0/0
[R1-Serial4/0/0]ppp chap user 
[R1-Serial4/0/0]ppp chap password cipher huawei

R1 and R3 can be ping ed

The connection between pc2 and pc1 is also normal

Posted by gordo2dope on Fri, 17 Sep 2021 18:57:14 -0700