Showing posts with label PPP. Show all posts
Showing posts with label PPP. Show all posts

Monday, May 23, 2011

LAB: PPP over Frame Relay

Requirements:  no router may use subinterface

==============================================
100.100.100.0/24

R2
int virtual-template 1
ip address 100.100.100.2 255.255.255.0 
bandwidth  64

int s0/1/0
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay interface-dlci 204 ppp virtual-template 1
frame-relay interface-dlci 205 ppp virtual-template 1
frame-relay interface-dlci 206 ppp virtual-template 1

R4
int virtual-template 1
ip address 100.100.100.4 255.255.255.0 
bandwidth  64

int s0/0/0
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay interface-dlci 402 ppp virtual-template 1

R5
int virtual-template 1
ip address 100.100.100.5 255.255.255.0
bandwidth  64

int s0/1/0
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay interface-dlci 502 ppp virtual-template 1

R6
int virtual-template 1
ip address 100.100.100.6 255.255.255.0
bandwidth  64

int s0/1/0
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay interface-dlci 602 ppp virtual-template 1

note:
- virtual access interface nos. issuing shut/no shut it will not assume always the same nos of virtual access interface.
- show ip route - will show /32 for virtual access. so might create problem on some dynamic routing.


==============================================
100.100.110.0/24


R2
int virtual-template2
ip address 100.100.110.2 255.255.255.0 
bandwidth  64

int s0/1/0
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay interface-dlci 215 ppp virtual-template 2
frame-relay interface-dlci 216 ppp virtual-template 2


R5
int virtual-template 2
ip address 100.100.110.5 255.255.255.0
bandwidth  64

int s0/1/0
ip address 100.100.100.5 255.255.255.0
frame-relay interface-dlci 512 ppp virtual-template 2

R6
int virtual-template2
ip address 100.100.110.6 255.255.255.0

int s0/1/0
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay interface-dlci 612 ppp virtual-template 2

verification
show int virtual access 2 - information inherited shows 100M link from virtual template
need to update the BW at virtual template

==============================================
100.100.120.0/24 128K 2 pvcs are active using 64k
note: there will be no load sharing / you can use multilink.

R2
int virtual-template 3
ip address 100.100.120.2 255.255.255.0 
bandwidth  64  
ppp multilink

int s0/1/0
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay interface-dlci 224 ppp virtual-template 3
frame-relay interface-dlci 214 ppp virtual-template 3


R4
int virtual-template 3
ip address 100.100.120.4 255.255.255.0 
bandwidth  64  
ppp multilink

int s0/0/0
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay interface-dlci 412 ppp virtual-template 3
frame-relay interface-dlci 422 ppp virtual-template 3


verification:

show ip route - there will one single set of /32 virutal access #
show int virtual-access # - will show only inherited 64k from virtual-template
show ppp multilink  - will show 2 member w total of 128K (definitive answer)

Sunday, May 22, 2011

LAB: Frame Relay Fragmentation and Interleaving with MLPPP

Repost from INE blog by Petr Lapukhov, 4xCCIE/CCDE:


1) MLPPP uses fragmentation scheme where large packets are sliced in pieces and sequence numbers are added using special MLPPP headers
2) Small voice packets are interleaved with fragments of large packets using a special priority queue

We see that MLPPP was originally designed to work with multiple physical links at the same time. However, PPP Multilink Interleave only works with one physical link. The reason is that voice (small) packets are being sent without sequence numbers. If we were using multiple physical links, the receiving side may start accepting voice packets out of their original order (due to different physical link latencies). And since voice packets bear no fragmentation headers, there is no way to reorder them. In effect, packets may arrive to their final destination out of order, degrading voice quality.

To overcome this obstacle, Multiclass Multilink PPP (MCMLPPP or MCMLP) has been introduced in RFC 2886. Under this RFC, different “fragment streams” or classes are supported at sending and receiving sides, using independent sequence numbers. Therefore, with MCMLPPP voice packets may be sent using MLPPP header with separate sequence numbers space. In result, MCMPPP permits the use of fragmentation and interleaving over multiple physical links at time.

Now back to our MLPPPoFR example. Let’s imagine the situation where we have two routers (R1 and R2) connected via FR cloud, with physical ports clocked at 512Kpbs and PVC CIR values equal to 384Kbps (There is no ATM interworking in this example). We need to provide priority treatment to voice packets and enable PPP Multilink and Interleave to decrease serialization delays.

Topology:

[R1]---[DLCI 112]---[Frame-Relay]---[DLCI 211]---[R2] 
 
Qos Policy:R1
 
class-map match-all VOICE
 match ip dscp ef 
class-map match-all SIGNALING
 match ip dscp cs3 
!
!
policy-map CBWFQ
 class VOICE
  priority 48
 class SIGNALING
  bandwidth 8
 class class-default
  fair-queue
 
 Next create a Virtual-Template interface for PPPoFR. We need to 
calculate the fragment size for MLPPP. Since physical port speed is 
512Kpbs, and required serialization delay should not exceed 10ms 
(remember, fragment size is based on physical port speed!), the fragment
 size must be set to [512000/8]*0.01=640 bytes. How is the fragment size 
configured with MLPPP? By using command ppp multilink fragment delay
 – however, IOS CLI takes this delay value (in milliseconds) and 
multiplies it by configured interface (virtual-template) bandwidth (in 
our case 384Kbps). We can actually change the virtual-template bandwidth
 to match the physical interface speed, but this would affect the CBWFQ 
weights! Therefore, we take the virtual-template bandwidth (384Kpbs) and
 adjust the delay to make sure the fragment size matches the physical 
interace rate is 512Kpbs. This way, the “effective” delay value would be
 set to “640*8/384 = 13ms” (Fragment_Size/CIR*8) to accomodate the 
physical and logical bandwidth discrepancy. (This may be unimportant if 
our physical port speed does not differ much from PVC CIR. However, if 
you have say PVC  CIR=384Kbps and port speed 768Kbps you may want to pay
 attention to this issue)
 
R1:
interface Loopback0
 ip address 177.1.101.1 255.255.255.255
!
interface Virtual-Template1
 bandwidth 384
 ip unnumbered Loopback0
 ppp multilink
 ppp multilink fragment delay 13
 ppp multilink interleave
 service-policy output CBWFQ
R2:
interface Loopback0
 ip address 177.1.102.1 255.255.255.255
!
interface Virtual-Template1
 bandwidth 384
 ip unnumbered Loopback0
 ppp multilink
 ppp multilink fragment delay 13
 ppp multilink interleave
 service-policy output CBWFQ
Next we configure PVC shaping settings by using legacy FRTS configuration. Note that Bc is set to CIR*10ms.
 
R1&R2
map-class frame-relay SHAPE_384K
 frame-relay cir 384000
 frame-relay bc 3840
 frame-relay be 0
 frame-relay mincir 384000
apply all the settings to the Frame-Relay interfaces:
 
R1:
interface Serial0/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
 frame-relay traffic-shaping
!
interface Serial0/0.1 point-to-point
 frame-relay interface-dlci 112 ppp Virtual-Template1
  class SHAPE_384K
R2:
interface Serial0/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
 frame-relay traffic-shaping
!
interface Serial0/0.1 point-to-point
 frame-relay interface-dlci 211 ppp Virtual-Template1
  class SHAPE_384K
 
Verification
 
R1#SHOW INT VIRtual-ACCess 2
Virtual-Access2 is up, line protocol is up
  Hardware is Virtual Access interface
  Interface is unnumbered. Using address of Loopback0 (177.1.101.1)
  MTU 1500 bytes, BW 384 Kbit/sec, DLY 100000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation PPP, LCP Open, multilink Open
  Link is a member of Multilink bundle Virtual-Access3
  PPPoFR vaccess, cloned from Virtual-Template1
  Vaccess status 0x44
  Bound to Serial0/0.1 DLCI 112, Cloned from Virtual-Template1, loopback not set
  Keepalive set (10 sec)
  DTR is pulsed for 5 seconds on reset
  Last input 00:00:05, output never, output hang never
  Last clearing of "show interface" counters 00:48:42
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     572 packets input, 10084 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     572 packets output, 8960 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out
     0 carrier transitions
R1#
R1#
R1#SHOW INT VIRtual-ACCess 3
Virtual-Access3 is up, line protocol is up
  Hardware is Virtual Access interface
  Interface is unnumbered. Using address of Loopback0 (177.1.101.1)
  MTU 1500 bytes, BW 384 Kbit/sec, DLY 100000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation PPP, LCP Open, multilink Open
  Open: IPCP
  MLP Bundle vaccess, cloned from Virtual-Template1
  Vaccess status 0x40, loopback not set
  Keepalive set (10 sec)
  DTR is pulsed for 5 seconds on reset
  Last input 00:37:26, output never, output hang never
  Last clearing of "show interface" counters 00:47:35
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: Class-based queueing
  Output queue: 0/1000/64/0 (size/max total/threshold/drops)
     Conversations  0/1/128 (active/max active/max total)
     Reserved Conversations 1/1 (allocated/max allocated)
     Available Bandwidth 232 kilobits/sec
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     12 packets input, 1068 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     12 packets output, 1134 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out
     0 carrier transitions
R1#
R1#show policy-map inte
R1#show policy-map interface
 Virtual-Template1

  Service-policy output: CBWFQ

    Service policy content is displayed
                    for cloned interfaces only such as vaccess and
                    sessions
 Virtual-Access3

  Service-policy output: CBWFQ

    Class-map: VOICE (match-all)
      5 packets, 510 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp ef (46)
      Queueing
        Strict Priority
        Output Queue: Conversation 136
        Bandwidth 48 (kbps) Burst 1200 (Bytes)
        (pkts matched/bytes matched) 5/510
        (total drops/bytes drops) 0/0

    Class-map: SIGNALING (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp cs3 (24)
      Queueing
        Output Queue: Conversation 137
        Bandwidth 8 (kbps)Max Threshold 64 (packets)
        (pkts matched/bytes matched) 0/0
        (depth/total drops/no-buffer drops) 0/0/0

    Class-map: class-default (match-any)
      7 packets, 534 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any
      Queueing
        Flow Based Fair Queueing
        Maximum Number of Hashed Queues 128
        (total queued/total drops/no-buffer drops) 0/0/0
 
R1# show ppp multilink 

Virtual-Access3, bundle name is R2
  Endpoint discriminator is R2
  Bundle up for 00:49:28, total bandwidth 384, load 1/255
  Receive buffer limit 12192 bytes, frag timeout 1000 ms
  Interleaving enabled
    0/0 fragments/bytes in reassembly list
    0 lost fragments, 0 reordered
    0/0 discarded fragments/bytes, 0 lost received
    0x7 received sequence, 0x7 sent sequence
  Member links: 1 (max not set, min not set)
    Vi2, since 00:49:28, 624 weight, 614 frag size
No inactive multilink interfaces
R1#
R1#
R1#
R1#sho int s0/0
Serial0/0 is up, line protocol is up 
  Hardware is M4T
  MTU 1500 bytes, BW 1544 Kbit/sec, DLY 20000 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation FRAME-RELAY, crc 16, loopback not set
  Keepalive set (10 sec)
  Restart-Delay is 0 secs
  LMI enq sent  298, LMI stat recvd 299, LMI upd recvd 0, DTE LMI up
  LMI enq recvd 0, LMI stat sent  0, LMI upd sent  0
  LMI DLCI 0  LMI type is ANSI Annex D  frame relay DTE
  FR SVC disabled, LAPF state down
  Broadcast queue 0/64, broadcasts sent/dropped 49/0, interface broadcasts 0
  Last input 00:00:05, output 00:00:02, output hang never
  Last clearing of "show interface" counters 00:50:43
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: dual fifo
  Output queue: high size/max/dropped 0/256/0
  Output queue: 0/128 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     947 packets input, 31366 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     946 packets output, 31062 bytes, 0 underruns
     0 output errors, 0 collisions, 2 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out
     2 carrier transitions     DCD=up  DSR=up  DTR=up  RTS=up  CTS=up 

Saturday, May 21, 2011

LAB: Frame Relay Multilink PPP

 w / in the virtual template use PPP multilink in order to bond together.

in this example 2 x 2M of frame-relay  are bundled to have a total of 4M effective bandwidth.

    interface Serial0/0
    description Physical Interface 1
    bandwidth 2000
    no ip address
    encapsulation frame-relay
    frame-relay fragmentation voice-adaptive deactivation 15
    frame-relay traffic-shaping
    frame-relay interface-dlci 16 ppp Virtual-Template1
    frame-relay lmi-type ansi

    interface Serial0/1
    description Physical Interface 2
    bandwidth 2000
    no ip address
    encapsulation frame-relay
    frame-relay fragmentation voice-adaptive deactivation 15
    frame-relay traffic-shaping
    frame-relay interface-dlci 16 ppp Virtual-Template1
    frame-relay lmi-type ansi

    interface Virtual-Template1
    no ip address
    ppp multilink
    ppp multilink group 1

    interface Multilink1
    description Bundled Interface
    bandwidth 4000
    ip address 10.87.1.1 255.255.255.248
    ppp multilink
    ppp multilink group 1

Thursday, March 31, 2011

notes: PPP Half-Bridging

- When a serial interface is configured as a PPP half-bridge, the link to the remote bridge functions as a virtual ethernet interface, with the serial interface functioning as a node on that remote network.
- When a packet is received by the PPP half-bridge, it is converted to a routed packet and forwarded normally.
- The reverse process happens for packets destined for the remote bridge.
- An interface cannot function as both a half-bridge and a bridge.
-----------
COMMANDS
-----------

Enables PPP half-bridging for IP (Must be done before configuring the IP.)

interface Ethernet0
ppp bridge ip
encapsulation ppp
ip address 10.1.1.2 255.0.0.0


- Provides a protocol address on the same subnetwork as the remote network.

example config guide:

http://www.cisco.com/en/US/tech/tk713/tk507/technologies_configuration_example09186a0080093c80.shtml

notes: PPP over Frame-Relay (PPPoFR)

- Frame-relay does not natively support features such as authentication, link quality monitoring, or reliable transmission.
- By implementing PPPoFR, authentication of frame-relay PVCs can be implement, or multiple PVCs could be binded together using MLP.
- PPPoFR is configured through the use of a virtual-template interfaces.
- A virtual-template is a PPP encapsulated interface that is designed to spawn a “template” of configuration down to multiple member interfaces.
- When using a virtual-template interface it’s important to understand that a virtual-access “member” interface is cloned from the virtual-template interface when the PPP connection comes up, therefore the virtual-template interface itself will always be in the down/down state. This can affect certain network designs such as using the backup interface command
on a virtual-template.


note: the oly way to do authentication over FR is through PPP.

CONFIG-SET: PPP over frame-relay (PPPoFR) example
+---------------------------------------------------

STEP1: Create the virtual-template interface
- Configures all the logical options like a IP address
- Authentication is optional
NOTE: "encapsulation ppp" not needed as virtual-templates always runs PPP

interface virtual-template1
ip address 192.1.7.6 255.255.255.0
ppp chap hostname ROUTER6
ppp chap password 0 CISCO


STEP2: Configure the physical frame-relay interface and bind the virtual-template to the frame-relay PVC
Note that the order that these steps are performed are important

interface Serial0/0
encapsulation frame-relay
frame interface-dlci 201 ppp virtual-template1



verification:

sh ip interface brief | include 192.1.7.6
virtual-access1 192.1.7.6 YES TFTP up up
virtual-template1 192.1.7.6 YES manual down down

notes: PPP Multilink PPP (MLP)

- MLP provides a method for spreading traffic across multiple physical WAN links while providing packet fragmentation and reassembly, proper sequencing, multivendor interoperability, and load balancing on inbound and outbound traffic.
- MLP fragmentation sends the fragments simultaneously over multiple point-to-point links to
the same remote address.
- MLP can measure the load on just inbound traffic, or on just outbound traffic, but not on the combined load of both inbound and outbound traffic.

CONFIG-SET: MLP - Configuring a Multilink PPP Bundle
+-----------------------------------------------------
interface s0/0
no ip add
encapsulation ppp
ppp multilink
multilink-group 2
!
interface s0/1
no ip add
encapsulation ppp
ppp multilink - Enables MLP on S0/1
multilink-group 2
!
interface multilink2
ip address 192.168.0.1 255.255.255.0
ppp multilink
multilink-group 2


LFI (Link Fragmentation and Interleaving)

- Interleaving on MLP allows large packets to be multilink encapsulated and fragmented into a small enough size to satisfy the delay requirements of real-time traffic; small real-time packets are not multilink encapsulated and are transmitted between fragments of the large packets.

- The interleaving feature also provides a special transmit queue for the smaller, delay-sensitive packets, enabling them to be transmitted earlier than other flows.

- Interleaving applies only to interfaces that can configure a multilink bundle interface.

- WFQ on MLP works at the packet level, not at the level of multilink fragments.
- Maximum fragment delay: If one specifies 20 ms delay, MLP will choose a fragment size based on the configured value.


MCMP (Multi-class Multilink PPP)

- This feature allows the delivery of delay-sensitive packets, such as the packets of a voice call, to be expedited by omitting the PPP multilink protocol header and sending the packets as raw
PPP packets in between the fragments of larger data packets.

MRRU Negotiation

- The PPP/MLP MRRU negotiation configuration feature allows a router to send and receive frames over MLP bundles that are larger than the default Maximum Receive Reconstructed Unit (MRRU) limit of 1524 bytes.
-----------
COMMANDS
-----------

interface s0/1
ppp multilink - Enables MLP
multilink-group {no} - Specifies interface multilink group membership
ppp multilink interleave - Enables LFI, real-time packet interleaving
ppp multilink fragment-delay {ms} - (o) Configure a maximum fragment delay
ppp multilink multiclass - Enables MCMP on an interface
ppp multilink mrru [local | remote] {mrru-value}

- Configures the MRRU value negotiated on a MLP bundle
- [local] Configures the local MRRU value
- [remote] The min value to be accepted from the peer

notes: PPP Link Quality Monitoring (LQM)

- The PPP suite includes a feature that allows devices to analyze the quality of the link.
- LCP provides an optional link quality determination phase. In this phase, LCP tests the link to determine whether the link quality is sufficient to use layer3 protocols.

- The command "ppp quality percentage" ensures that the link meets the quality requirement set; otherwise, the link is brought down.
- The percentages are calculated for both incoming and outgoing directions.
-----------
COMMANDS
-----------
debug ppp packet - Shows specific LCP operation

interface s0
ppp quality {percentage}
- Enables link quality monitoring

notes: PPP Reliable Link (RFC 1663)

- Defines a method of negotiating and using Numbered Mode LAPB to provide a reliable serial link.
- Numbered Mode LAPB provides retransmission of errored packets across the serial link.
- PPP reliable link can be used with PPP compression over the link, but it does not require PPP compression.
- PPP reliable link does not work with multilink PPP.

-----------
COMMANDS
-----------
show int - Will show whether LAPB has been established on the link.
debug lapb - Displays all traffic for interfaces using LAPB encapsulation.

interface s0
ppp reliable-link
- Enables PPP reliable-link

notes: PPP Peer neighbhor route

A /32 is automatically created for neighbor routes by default.

- It automatically sets up a route to the peer address on a point-to-point interface when the PPP IPCP negotiation is completed.

- It is useful to provide reachability when both ends of the PPP link are not on the same logical subnet. ie IP-unnumbered.

- Can be safely disabled when both ends of the link are in the same logical subnet.
- If using IP-unnumbered or dissimilar IP subnets on a data-link, leave it enabled.

- Most commonly used when different IP subnets on the same physical segment.
> R1 S1/0 is directly connected to R2 S2/0.
> R1 S1/0: IP address is 4.4.4.4/24.
> R2 S2/0: IP address is 5.5.5.5/24.
> R2 will have 4.4.4.4 in the routing table as 4.0.0.0/8 and 4.4.4.4 will be pingable.
> R1 will have 5.5.5.5 in the routing table as 5.0.0.0/8.
> Problems is that only the IP address is advertised to a PPP neighbor, and not the SUBNET MASK, it will assume classful boundary.

-----------
COMMANDS
-----------

interface E0
no peer neighbor-route


- Disables peer neighbor route, then connected IP address won’t be advertised
- Disables /32 host routes for the interface

notes: PPP Peer Address allocation

During IPCP negotiation, if the peer presents a peer IP address during IPCP address negotiation and the peer router has no address is assigned, the presented address is acknowledged and used in the current session.

CONFIG-SET: PPP IPCP address allocation

R5:

interface Serial0/2/0

ip address 192.168.205.5 255.255.255.0
encapsulation ppp
peer default ip address 192.168.205.2
ppp lcp predictive
ppp ipcp predictive


R2:

interface Serial0/1/0

ip address negotiated
encapsulation ppp
clock rate 2000000
ppp lcp predictive
ppp ipcp predictive



verification:

R2#sh ip int brief | i Serial0/2/0
Serial0/2/0 192.168.205.2 YES IPCP up up - Notice the method is IPCP (IP Control Protocol)

Wednesday, March 30, 2011

LAB: PPPoE


LAB: PPPoE

requirements:

-configure R3 as PPPoE client and R5 as the PPPoE server.
-use r3 fa0/a and r5 sub-interface fa0/1.35
-r5 should block any host attempting to initiate more than 10 sessions in a minute for 5 minutes
-allowed to create additional vlan 35 for this task
- r5 should allocate ip address to r3 from the local dhcp pool for the subnet 155.1.35.0
-make sure R3 is assigned the ip address 155.1.35.3 from the pool.
-r5 should authenticate r3 using chap and the password value of CISCO


Configuring R5 as PPoE Server

step 1: configure authentication parameters

aaa authentication ppp PPPOE local
username R3PPP password CISCO

step2: configure dhcp pool for the PPPoE clients. ip dhcp exluded is configured to ensure .3 is assigned to R3

ip dhcp pool PPPoE
network 155.1.35.0 255.255.255.0
!
ip dhcp excluded-address 155.1.35.1 155.1.35.2
ip dhcp excluded-address 155.1.35.4 155.1.35.254


step3: define bba-group

bba-group pppoe PPPoE
virtual-template 1
sessions per-mac throttle 10 60 300



step4: configure virtual template / authentication ppp chap

interface virtual-template 1
ip mtu 1492
encapsulation ppp
ip address 155.1.35.1 255.255.255.0
ppp authentication chap PPPOE

step 5: enable pppoe on the physical interface:

int fa0/1.35
pppoe enable group PPPoE



configure R3 as PPPoE client

step1: configure interface dialer

interface Dialer1
ip mtu 1492
ip address dhcp
encapsulation ppp
dialer pool 1
ppp chap hostname R3PPP
ppp chap password 0 CISCO

step2: configure the physical interface

interface FastEthernet0/1
pppoe enable group global
pppoe-client dial-pool-number 1


note: if a router is used as PPPoE client ff issues may arise;

1. some igp protocols e.g. OSPF may fail to negotiate across the virtual link due to MTU mismatch. This could be fixed using the command " ip ospf mtu-ignore" with OSPF or by setting the mtu value manually at both ends. in this case we set it at 1492 mtu size.


2. PMTU discovery may fail due to firewall filtering and TCP sessions may not work properly. This could be fixed using the command "ip tcp adjust-mss 1452" (or lower) on virtual interface e.g. dialer on the clien router.


verification:

show ip int brief

show pppoe session

notes: PPPoE

- The PPPoE client feature provides PPPoE client support on ATM PVCs (permanent virtual circuits) and ethernet interfaces.
- A dialer interface must be used for cloning virtual access.
- A PPPoE session is initiated by the PPPoE client.
- PPPoE is a commonly used application in the deployment of digital subscriber lines (DSL).
- The PPP over ethernet client feature expands PPPoE functionality by providing support for PPPoE on the client as well as on the server.
- PPP is configured on the physical interface and IP on the logical interface.
- A virtual-template interface is a PPP interface, no need for 'encapsulation ppp'.
- This can be seen with "sh interface virtual-template1"
- It is recommended that you set the MTU to 1492 bytes. This value accommodates a PPPoE header encapsulation of 8 bytes in the ethernet frame payload.

Dialer persistent feature:

- Allows a dial-on-demand routing (DDR) dialer profile connection to be brought up without being triggered by interesting traffic.
- The connection is not brought down until the shutdown interface command is entered on the dialer interface.
- If the persistent connection is torn down for some other reason, the system immediately tries to bring the connection back up.
- The dialer persistent command starts a timer when the dialer interface starts up and starts the connection when the timer expires.


CONFIG-SET: PPP over Ethenet (PPPoE) configuration
+---------------------------------------------------------------
R2 > PPPoE SERVER CONFIG
!
username test password test
!
bba-group pppoe global
vitual-template 1
!
ip local pool PPPoE 172.16.0.20 172.16.0.29
!
interface e0/1
ip address 10.0.0.6 255.255.255.0
pppoe enable group global
!
interface virtual-template1
ip address 172.16.0.12 255.255.255.255
ip mtu 1492
peer default ip address pool PPPoE
ppp authentication chap callin



R1 > PPPoE CLIENT CONFIG
!
bba-group pppoe global
!
interface fa0/0
ip address 10.0.0.5 255.255.255.0
!
interface fa1/0 - Configures the outside interface
no ip address
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface dialer 0
ip address negotiated
ip mtu 1492
encapsulation ppp
dialer-pool 1
dialer-group 1
ppp authentication chap callout optional
ppp chap hostname test
ppp chap password 0 test
!
ip route 0.0.0.0 0.0.0.0 Dialer0
dialer-list 1 protocol ip permit


show commands and verification

show vpdn - Displays information about active Layer2 Forwarding (L2F) protocol
show vpdn session packet - Displays PPPoE session statistics
show vpdn session all - Displays PPPoE session information for each session ID
show vpdn tunnel - Displays PPPoE session count for the tunnel
clear vpdn tunnel pppoe - Terminates PPPoE session and immediately try to re-establish the session
clear interface dialer {number} - With dialer persistent, re-attempts to bring up the connection
debug vpdn pppoe-data - Displays PPPoE session data packets
debug vpdn pppoe-errors - Displays errors preventing a session establishment and terminating errors
debug vpdn pppoe-events - Displays PPPoE session establishment events messages
debug vpdn pppoe-packets - Displays each PPPoE protocol packet exchanged
debug dialer - Displays info about the packets received on a dialer interface

Tuesday, March 29, 2011

LAB: PPP AAA Authentication

requirements:

- r4 to authenticate R5 against the RADIUS server IP 155.1.146.100
-r5 to authenticate r4 against the tacacs+ server IP 155.1.146.200
- if both remote servers fail r4 and r5 should use local user db for authentication.
- use cisco to authenticate the remote servers.
- dont use global commands to define the radius server in r4.

fyi: r4 authenticates r5 using ppp and chap. r5 authenticates r4 using pap only.

R4:
aaa new-model
!
!
aaa group server radius MYRADIUS
server-private 155.1.146.100 auth-port 1645 acct-port 1646 key CISCO
!
aaa authentication login CONSOLE none
aaa authentication ppp PPPAUTH group MYRADIUS local
!
interface Serial0/1
ppp authentication pap chap PPPAUTH
!
line con 0
login authentication CONSOLE


R5

aaa new-model
!
!
aaa authentication login CONSOLE none
aaa authentication ppp default group tacacs+ local
!
tacacs-server host 155.1.146.200 key CISCO
!
line con 0
login authentication CONSOLE

notes: PPP Authentication

PPP

One of the most important networking protocols is the Point-to-Point Protocol (PPP). Not only can you use it to transport many network protocols over point-to-point links, but it also provides capabilities to add authentication and link quality testing, allocate IP addresses, and provide error detection. The four major parts to PPP are network datagram encapsulation (such as
HDLC), link setup, termination and maintenance, and network layer protocol establishment and configuration. When you establish a PPP link, the link setup and maintenance protocol, LCP, is used. LCP is responsible for PPP link establishment, termination, and maintenance. When the link is established, different parameters are exchanged and the link can optionally be quality tested. After the link establishment phase, the Network Control Protocols (NCP) takes over and facilitates the transfer of Layer 3 protocols, such as IP.

To configure a serial link to use PPP, simply set the encapsulation:

Router(config-if)# encapsulation ppp

One of the features of PPP encapsulation is the capability to authenticate the link. PPP can use either Password Authentication Protocol (PAP) or Challenge-Handshake Authentication Protocol (CHAP). CHAP authentication is considered more securethan PAP authentication because the username and password are not transferred in the clear as they are in PAP. Instead CHAP
uses more secure hashs and frequent challenges that add security to the authentication process.

To configure PAP on a serial interface, the authentication credentials must be created first. This is typically done by creating a username and password combination on each router. The interface then contains a command that specifies what will be sent to the peer router. If the two match, authentication will succeed:


CONFIG-SET: PPP one-way PAP authentication

Example: R2 connects to R1, where R1 authentication R2

R1#
username R2C password cisco
!
interface s1/0
encapsulation ppp
ppp pap authentication pap
ppp max-bad-auth 3


R2#
interface s2/1
ppp pap sent-username R2C password cisco
ppp max-bad-auth 3


CHAP authentication is configured slightly different because the hostname of the routers are involved. A username is created matching the hostname of the peer router, and the password supplied must match:

- By default, the router uses its hostname to identify itself to the peer, but can be changed with "ppp chap hostname".
- A interface level CHAP hostname overwrites the routers global hostname.
- If the same host name is specified on both sides, the session authentication will fail, as the router ignores a authentication-request from its own hostname. To get around that issue the hidden command "no ppp chap ignoreus".
- A global password is always tried first and then a interface-level password will be tried.
- CHAP is defined as a one-way authentication method, but if applied in both directions it create two-way authentication.


CONFIG-SET : PPP two-way CHAP authentication
note password must match between peers

R2#
username CCIE password 0 cisco
!
interface Serial0/2
ip address 10.0.24.2 255.255.255.0
encapsulation ppp
ppp authentication chap


R4#
username R2 password 0 cisco
!
interface Serial1/0
ip address 10.0.24.4 255.255.255.0
encapsulation ppp
ppp authentication chap
ppp chap hostname CCIE


Unfortunately, configuring PAP and CHAP on a PPP over Frame Relay is not be as easy as enabling or disabling the authentication. When dealing with Frame Relay interfaces, a virtual-template must be configured and applied to the interface.

1. First, a virtual-template interface must be created, and it’s encapsulation must be PPP:

Router(config)# hostname R1
R1(config)# int virtual-template <#>
R1(config-if)# encapsulation ppp



The IP address from the serial interface is moved to the virtual-template:

R1(config)# int
R1(config-if)# no ip address
R1(config-if)# int virtual-template <#>
R1(config-if)# ip address

The frame-relay interface-dlci is programmed to reference the virtual-template:

R1(config-if)# frame-relay interface-dlci ppp virtual-template <#>


Now authentication can be configured on the virtual-template as before:

R1(config-if)# ppp authentication chap
or
R1(config-if)# ppp authentication pap