|
CISCO路由器配置手册
六、PSTN
电话网络(PSTN)是目前普及程度最高、成本最低的公用通讯网络，它在网络互连中也有广泛的应用。电话网络的应用一般可分为两种类型，一种是同等级别机构之间以按需拨号(DDR)的方式实现互连，一种是ISP为拨号上网为用户提供的远程访问服务的功能。
1. 远程访问
1.1.Access
Server基本设置：
选用Cisco2511作为访问服务器,采用IP地址池动态分配地址.远程工作站使用WIN95拨号网络实现连接。
全局设置：
|
任务 |
命令 |
|
设置用户名和密码 |
username username password password |
|
设置用户的IP地址池 |
ip local pool {default | pool-name low-ip-address
[high-ip-address]} |
|
指定地址池的工作方式 |
ip address-pool [dhcp-proxy-client | local] |
基本接口设置命令：
|
任务 |
命令 |
|
设置封装形式为PPP |
encapsulation ppp |
|
启动异步口的路由功能 |
async default routing |
|
设置异步口的PPP工作方式 |
async mode {dedicated | interactive} |
|
设置用户的IP地址 |
peer default ip address {ip-address |
dhcp | pool [pool-name]} |
|
设置IP地址与Ethernet0相同 |
ip unnumbered ethernet0 |
line拨号线设置：
|
任务 |
命令 |
|
设置modem的工作方式 |
modem {inout|dialin} |
|
自动配置modem类型 |
modem autoconfig discovery |
|
设置拨号线的通讯速率 |
speed speed |
|
设置通讯线路的流控方式 |
flowcontrol {none | software [lock] [in | out] |
hardware [in | out]} |
|
连通后自动执行命令 |
autocommand command |
访问服务器设置如下：
Router:
hostname Router
enable secret 5
$1$EFqU$tYLJLrynNUKzE4bx6fmH//
!
interface Ethernet0
ip address 10.111.4.20
255.255.255.0
!
interface Async1
ip unnumbered Ethernet0
encapsulation ppp
keepalive 10
async mode interactive
peer default ip address pool
Cisco2511-Group-142
!
ip local pool
Cisco2511-Group-142 10.111.4.21 10.111.4.36
!
line con 0
exec-timeout 0 0
password cisco
!
line 1 16
modem InOut
modem autoconfigure
discovery
flowcontrol hardware
!
line aux 0
transport input all
line vty 0 4
password cisco
!
end
相关调试命令：
show interface
show line
1.2.
Access Server通过Tacacs服务器实现安全认证：
使用一台WINDOWS NT服务器作为Tacacs服务器，地址为10.111.4.2,运行Cisco2511随机带的Easy
ACS 1.0软件实现用户认证功能.
相关设置：
|
任务 |
命令 |
|
激活AAA访问控制 |
aaa new-model |
|
用户登录时默认起用Tacacs+做AAA认证 |
aaa authentication login default tacacs+ |
|
列表名为no_tacacs使用ENABLE口令做认证 |
aaa authentication login no_tacacs enable |
|
在运行PPP的串行线上采用Tacacs+做认证 |
aaa authentication ppp default tacacs+ |
|
由TACACS+服务器授权运行EXEC |
aaa authorization exec tacacs+ |
|
由TACACS+服务器授权与网络相关的服务请求。 |
aaa authorization network tacacs+ |
|
为EXEC会话运行记帐.进程开始和结束时发通告给TACACS+服务器。 |
aaa accounting exec start-stop tacacs+ |
|
为与网络相关的服务需求运行记帐包括SLIP,PPP,PPP
NCPs,ARAP等.在进程开始和结束时发通告给TACACS+服务器。 |
aaa accounting network start-stop tacacs+ |
|
指定Tacacs服务器地址 |
tacacs-server host 10.111.4.2 |
|
在Tacacs+服务器和访问服务器设定共享的关键字，访问服务器和Tacacs+服务器使用这个关键字去加密口令和响应信息。这里使用tac作为关键字。 |
tacacs-server key tac |
访问服务器设置如下：
hostname router
!
aaa new-model
aaa authentication login
default tacacs+
aaa authentication login
no_tacacs enable
aaa authentication ppp
default tacacs+
aaa authorization exec
tacacs+
aaa authorization network
tacacs+
aaa accounting exec
start-stop tacacs+
aaa accounting network
start-stop tacacs+
enable secret 5
$1$kN4g$CvS4d2.rJzWntCnn/0hvE0
!
interface Ethernet0
ip address 10.111.4.20
255.255.255.0
!
interface Serial0
no ip address
shutdown
interface Serial1
no ip address
shutdown
!
interface Group-Async1
ip unnumbered Ethernet0
encapsulation ppp
async mode interactive
peer default ip address pool
Cisco2511-Group-142
no cdp enable
group-range 1 16
!
ip local pool
Cisco2511-Group-142 10.111.4.21 10.111.4.36
tacacs-server host
10.111.4.2
tacacs-server key tac
!
line con 0
exec-timeout 0 0
password cisco
login authentication
no_tacacs
line 1 16
login authentication tacacs
modem InOut
modem autoconfigure type
usr_courier
autocommand ppp
transport input all
stopbits 1
rxspeed 115200
txspeed 115200
flowcontrol hardware
line aux 0
transport input all
line vty 0 4
password cisco
!
end
2.
DDR（dial-on-demand routing）实例
此例通过Cisco 2500系列路由器的aux端口实现异步拨号DDR连接。Router1拨号连接到Router2。其中采用PPP/CHAP做安全认证，在Router1中应建立一个用户，以对端路由器主机名作为用户名，即用户名应为Router2。同时在Router2中应建立一个用户，以对端路由器主机名作为用户名，即用户名应为Router1。所建的这两用户的password必须相同。
相关命令如下：
|
任务 |
命令 |
|
设置路由器与modem的接口指令 |
chat-script script-name EXPECT SEND
EXPECT SEND (etc.) |
|
设置端口在挂断前的等待时间 |
dialer idle-timeout seconds |
|
设置协议地址与电话号码的映射 |
dialer map protocol next-hop-address
[name hostname] [broadcast] [modem-script
modem-regexp] [system-script system-regexp]
[dial-string]
|
|
设置电话号码 |
dialer string dial-string |
|
指定在特定线路下路由器默认
使用的chat-script |
script {dialer|reset} script-name |
Router1:
hostname Router1
!
enable secret 5 $1$QKI7$wXjpFqC74vDAyKBUMallw/
!
username Router2 password cisco
chat-script cisco-default ""
"AT" TIMEOUT 30 OK "ATDT \T" TIMEOUT 30 CONNECT \c
!
interface Ethernet0
ip address 10.0.0.1 255.255.255.0
!
interface Async1
ip address 192.200.10.1 255.255.255.0
encapsulation ppp
async default routing
async mode dedicated
dialer in-band
dialer idle-timeout 60
dialer map ip 192.200.10.2 name Router2 modem-script
cisco-default 573
dialer-group 1
ppp authentication chap
!
ip route 10.0.1.0 255.255.255.0 192.200.10.2
dialer-list 1 protocol ip permit
!
line con 0
line aux 0
modem InOut
modem autoconfigure discovery
flowcontrol hardware
Router2:
hostname Router2
!
enable secret 5 $1$F6EV$5U8puzNt2/o9g.t56PXHo.
!
username Router1 password cisco
!
interface Ethernet0
ip address 10.0.1.1 255.255.255.0
!
interface Async1
ip address 192.200.10.2 255.255.255.0
encapsulation ppp
async default routing
async mode dedicated
dialer in-band
dialer idle-timeout 60
dialer map ip 192.200.10.1 name Router1
dialer-group 1
ppp authentication chap
!
ip route 10.0.0.0 255.255.255.0 192.200.10.1
dialer-list 1 protocol ip permit
!
line con 0
line aux 0
modem InOut
modem autoconfigure discovery
flowcontrol hardware
!
相关调试命令：
debug dialer
debug ppp authentication
debug ppp error
debug ppp negotiation
debug ppp packet
show dialer
3.
异步拨号备份DDN专线：
此例主连接采用DDN专线，备份线路为电话拨号。当DDN专线连接正常时，主端口S0状态为up，line
protocol亦为up,则备份线路状态为standby，line protocol为down，此时所有通信均通过主接口进行。当主接口连接发生故障时，端口状态为down，则激活备份接口，完成数据通信。此方法不适合为X.25做备份。因为，配置封装为X.25的接口只要和X.25交换机之间的连接正常其接口及line
protocol的状态亦为 up,它并不考虑其它地方需与之通信的路由器的状态如何，所以若本地路由器状态正常，而对方路由器连接即使发生故障，本地也不会激活备份线路。例4将会描述如何为X.25做拨号备份。
以下是相关命令：
|
任务 |
命令 |
|
指定主线路改变后，次线路状态发生改变的延迟时间 |
backup delay {enable-delay | never}
{disable-delay | never} |
|
指定一个接口作为备份接口 |
backup interface type number |
hostname c2522rb
!
enable secret 5
$1$J5vn$ceYDe2FwPhrZi6qsIIz6g0
enable password cisco
!
username c4700 password 0
cisco
ip subnet-zero
chat-script cisco-default
"" "AT" TIMEOUT 30 OK "ATDT \T" TIMEOUT 30
CONNECT \c
chat-script reset atz
!
interface Ethernet0
ip address 16.122.51.254
255.255.255.0
no ip mroute-cache
!
interface Serial0
backup delay 10 10
backup interface Serial2
ip address 16.250.123.18
255.255.255.252
no ip mroute-cache
no fair-queue
!
interface Serial1
no ip address
no ip mroute-cache
shutdown
!
interface Serial2
physical-layer async
ip address 16.249.123.18
255.255.255.252
encapsulation ppp
async mode dedicated
dialer in-band
dialer idle-timeout 60
dialer map ip 16.249.123.17
name c4700 6825179
dialer-group 1
ppp authentication chap
!
interface Serial3
no ip address
shutdown
no cdp enable
!
interface Serial4
no ip address
shutdown
no cdp enable
!
interface Serial5
no ip address
no ip mroute-cache
shutdown
!
interface Serial6
no ip address
no ip mroute-cache
shutdown
!
interface Serial7
no ip address
no ip mroute-cache
shutdown
!
interface Serial8
no ip address
no ip mroute-cache
shutdown
!
interface Serial9
no ip address
no ip mroute-cache
shutdown
!
interface BRI0
no ip address
no ip mroute-cache
shutdown
!
router eigrp 200
network 16.0.0.0
!
ip classless
!
dialer-list 1 protocol ip
permit
!
line con 0
line 2
script dialer cisco-default
script reset reset
modem InOut
modem autoconfigure
discovery
rxspeed 38400
txspeed 38400
flowcontrol hardware
line aux 0
line vty 0 4
password cisco
login
!
end
c2522rb#
4.
异步拨号备份X.25:
设置X.25的拨号备份,首先X.25连接的端口必须运行动态路由协议,异步拨号口必须使用静态路由.本例选择EIGRP作为路由选择协议,将静态路由的Metric的值设置为200,由于EIGRP的默认Metric为90,所以当同时有两条路径通往同一网段时,其中Metric值小的路径生效,而当X.25连接出现问题时,路由器无法通过路由协议学习到路由表，则此时静态路由生效，访问通过拨号端口实现。当X.25连接恢复正常时，路由器又可以学习到路由表，则由于
Metric值的不同，静态路由自动被动态路由所代替，这样就实现了备份的功能。
路由器Router1配置如下:
hostname router1
!
enable secret 5
$1$UTvD$99YiY2XsRMxHudcYeHn.Y.
enable password cisco
!
username router2 password
cisco
ip subnet-zero
chat-script cisco-default
"" "AT" TIMEOUT 30 OK "ATDT \T" TIMEOUT 30
CONNECT \c
chat-script reset atz
interface Ethernet0
ip address 202.96.38.100
255.255.255.0
!
interface Serial0
ip address 202.96.0.1
255.255.255.0
encapsulation x25
x25 address 10112227
x25 htc 16
x25 map ip 202.96.0.2
10112225 broadcast
!
interface Serial1
no ip address
shutdown
!
!
interface Async 1
ip address 202.96.1.1
255.255.255.252
encapsulation ppp
dialer in-band
dialer idle-timeout 60
dialer map ip 202.96.1.2
name router2 modem-script cisco-default 2113470
dialer-group 1
ppp authentication chap
!
router eigrp 200
redistribute connected
network 202.96.0.0
!
ip route 202.96.37.0
255.255.255.0 202.96.1.2 200
dialer-list 1 protocol ip
permit
line con 0
line aux 0
script dialer cisco-default
script reset reset
modem InOut
modem autoconfigure
discovery
transport input all
rxspeed 38400
txspeed 38400
flowcontrol hardware
line vty 0 4
password cisco
login
!
end
路由器Router2配置如下:
hostname router2
!
enable secret 5
$1$T4IU$2cIqak8f/E4Ug6dLT0k.J0
enable password cisco
!
username router1 password
cisco
ip subnet-zero
chat-script cisco-default
"" "AT" TIMEOUT 30 OK "ATDT \T" TIMEOUT 30
CONNECT \c
chat-script reset atz
!
interface Ethernet0
ip address 202.96.37.100
255.255.255.0
!
interface Serial0
ip address 202.96.0.2
255.255.255.0
no ip mroute-cache
encapsulation x25
x25 address 10112225
x25 htc 16
x25 map ip 202.96.0.1
10112227 broadcast
!
interface Serial1
no ip address
shutdown
!
interface Async1
ip address 202.96.1.2
255.255.255.252
encapsulation ppp
keepalive 30
async default routing
async mode dedicated
dialer in-band
dialer idle-timeout 60
dialer wait-for-carrier-time
120
dialer map ip 202.96.1.1
name router1 modem-script cisco-default 2113469
dialer-group 1
ppp authentication chap
!
router eigrp 200
redistribute static
network 202.96.0.0
!
no ip classless
ip route 202.96.38.0
255.255.255.0 202.96.1.1 200
dialer-list 1 protocol ip
permit
!
line con 0
exec-timeout 0 0
line aux 0
script reset reset
modem InOut
modem autoconfigure
discovery
transport input all
rxspeed 38400
txspeed 38400
flowcontrol hardware
line vty 0 4
password cisco
login
!
end
返回目录
|
