Point-to-Point Protocol (PPP)

Transcription

1 Point-to-Point Protocol (PPP)

2 PPP» Point-to-Point Protocol» Open standard» Operates in the LLC sub-layer of data link layer in OSI» Originally designed for dial-up connections (modems, ISDN, etc.)» Only one possible destination

3 Point-to-Point Technologies» No Layer 3 to Layer 2 resolution required» Useful for wide area network, where leased lines exist or other P2P networks» Supports authentication PPP Frame Format Start Flag Address Control Protocol Code Data/ PPP Control FCS Final Flag Set to Static value Indicates whether next field is data, or PPP control frame

4 LCP and NCP» PPP must negotiate a connection» Moves through a series of required steps prior to transport of user data LCP Link Control Protocol Authentication (optional) NCP Network Control Protocol» State events and transitions can be monitored in real-time with debug ppp negotiations.

5 PPP- LCP (Link Control Protocol) Dial-Up or Circuit-Switched Network» LCP: negotiates link specific options Callback Multilink Authentication (whether or not to Authenticate) Magic Number (Loopback detection), etc.

6 LCP Message Exchanges LCP uses several different control messages Configuration-Request Lists all PPP options a sender wishes to implement such as authentication type, PPP Multilink, Callback, etc Configuration-Reject When a receiver doesn t support a particular feature and offers no suitable alternatives. Configuration-NAK (Negative Acknowledgement) When a receiver doesn t support a particular feature and offers an alternative. Configuration-Acknowledgement Acknowleding all LCP options in the most recent Config-Req that was received.

7 LCP Debug Jun Ser1/1 PPP Treating connection as a callout Jun Ser1/1 PPP Phase is ESTABLISHING, Active Open Jun Ser1/1 LCP O CONFREQ [Closed] id 5 len 15 Jun Ser1/1 LCP AuthProto CHAP (0x0305C22305) Jun Ser1/1 LCP MagicNumber 0x10BD9502 (0x050610BD9502) Jun Ser1/1 LCP I CONFREQ [REQsent] id 5 len 15 Jun Ser1/1 LCP AuthProto CHAP (0x0305C22305) Jun Ser1/1 LCP MagicNumber 0x10B8A083 (0x050610B8A083) Jun Ser1/1 LCP O CONFACK [REQsent] id 5 len 15 Jun Ser1/1 LCP AuthProto CHAP (0x0305C22305) Jun Ser1/1 LCP MagicNumber 0x10B8A083 (0x050610B8A083) Jun Ser1/1 LCP I CONFACK [ACKsent] id 5 len 15 Jun Ser1/1 LCP AuthProto CHAP (0x0305C22305) Jun Ser1/1 LCP MagicNumber 0x10BD9502 (0x050610BD9502) Jun Ser1/1 LCP St at e is Open

8 PPP- NCP: (Network Control Protocol)» Negotiate what Layer 3 Protocol to use For IP: IPCP For IPX: IPXCP Dial-Up or Circuit-Switched Network For CDP: CDPCP» Each of the above have protocol specific options that needs to be negotiated

9 NCP Debug *Mar Ser1/1 IPCP O CONFREQ [Closed] id 5 len 10 *Mar Ser1/1 IPCP Address (0x03060A010101) *Mar Ser1/1 CDPCP O CONFREQ [Closed] id 5 len 4 *Mar Ser1/1 IPCP I CONFREQ [REQsent] id 5 len 10 *Mar Ser1/1 IPCP Address (0x03060A010102) *Mar Ser1/1 IPCP O CONFACK [REQsent] id 5 len 10 *Mar Ser1/1 IPCP Address (0x03060A010102) *Mar Ser1/1 CDPCP I CONFREQ [REQsent] id 5 len 4 *Mar Ser1/1 CDPCP O CONFACK [REQsent] id 5 len 4 *Mar Ser1/1 IPCP I CONFACK [ACKsent] id 5 len 10 *Mar Ser1/1 IPCP Address (0x03060A010101) *Mar Ser1/1 IPCP State is Open *Mar Ser1/1 CDPCP I CONFACK [ACKsent] id 5 len 4 *Mar Ser1/1 CDPCP State is Open *Mar Ser1/1 IPCP Install route to

10 PPP Authentication» Two primary benefits of using PPP (as compared to other P2P WAN protocols): Dynamically learn Layer-3 address (via NCP) Authenticate your peer» PPP Authentication is optional, but almost always configured.» One-way or Bi-Directional Authentication» Various PPP Authentication methods available.

11 PAP» Password Authentication Protocol» Sends clear text username and password for authentication» Two-way handshake» Less secure than CHAP» By default, hostname is sent as the username

12 PAP Authentication One-way» PPP PAP authentication options One way (client authenticates against server) Chris (client) Ser0/0/0 Hello, I want to do PPP with you. Great, but I insist we use PAP. LCP My name is Chris, password is Cisco. That matches what I have. Auth Ser1/1/1 Sally (server) Hostname Chris interface serial 0/0/0 ip address encapsulation ppp ppp pap sent-username Chris password Cisco Hostname Sally Username Chris password Cisco interface serial 1/1/1 ip address encapsulation ppp ppp authentication pap

13 PAP Authentication Two-way Two way (both peers authenticate each other) Chris (client) Ser0/0/0 Hostname Chris Username Sally password Server interface serial 0/0/0 ip address encapsulation ppp ppp authentication pap ppp pap sent-username Chris password Cisco Hello, I want to do PPP with you. Great, but I insist we use PAP. LCP My name is Chris, password is Cisco. That matches what I have. My name is Sally, password is Server. That matches what I have. Auth Ser1/1/1 Sally (server) Hostname Sally Username Chris password Cisco interface serial 1/1/1 ip address encapsulation ppp ppp authentication pap ppp pap sent-username Sally password Server

14 Verifying PAP Authentication» Verification command Router# debug ppp negotiations Router# debug ppp authentication Router# show interface serial <number> Router# show users» In the debugs above you want to see: PPP: Received LOGIN Response PASS» Note: Upon successful authentication, a PAP server should show the users with IP addresses who are authenticated

15 CHAP» Challenge Handshake Authentication Protocol» Three-way handshake» More secure than PAP» By default, hostname is sent as the username; username can be explicitly configured

16 CHAP Authentication One-way Router (client) a123bc567 + Chris + Cisco = bbb55 Ser0/0/0 Hello, I want to do PPP with you. Great, but I insist we use CHAP. My name is Chris. My CHAP challenge is a123bc567. My challenge response = bbb55 Looks good You must really be Chris Ser1/1/1 Sally (server) a123bc567 + Chris + Cisco = bbb55 Hostname Router interface serial 0/0/0 ip address encapsulation ppp ppp chap hostname Chris ppp chap password Cisco Hostname Sally username Chris password Cisco interface serial 1/1/1 ip address encapsulation ppp ppp authentication chap

17 CHAP Authentication (Alternative Client Config) Router (client) Ser0/0/0 Hello, I want to do PPP with you. Great, but I insist we use CHAP. My name is Chris. My CHAP challenge is a123bc567. My challenge response = bbb55 Looks good You must really be Chris Ser1/1/1 Sally (server) Hostname Chris Username Sally password Cisco interface serial 0/0/0 ip address encapsulation ppp Hostname Sally username Chris password Cisco interface serial 1/1/1 ip address encapsulation ppp ppp authentication chap

18 CHAP Authentication Two-way Router (client) Hostname Router username Sally password Cisco interface serial 0/0/0 ip address encapsulation ppp ppp authentication chap ppp chap hostname Chris ppp chap password Cisco Ser0/0/0 Let s use PPP and CHAP, sound good?. I support that My name is Chris and I challenge you aa3355. My name is Sally and I challenge you 77ff5e. My challenge response = bbb55 My challenge response = eeccdd Looks good You must really be Sally Looks good You must really be Chris Ser1/1/1 Sally (server) Hostname Sally username Chris password Cisco interface serial 1/1/1 ip address encapsulation ppp ppp authentication chap ppp chap hostname Sally ppp chap password Cisco

19 Configuring CHAP Authentication (Server)» Change encapsulation Router(config-if)# encapsulation ppp» Create local user database Router(config)# username <username> password < password>» Configure CHAP server Router(config-if)# ppp authentication chap

20 Configuring CHAP Authentication (Client)» Change encapsulation Router(config-if)# encapsulation ppp» Configure to send username and password Router(config-if)# ppp chap password <password> Router(config-if)# ppp chap hostname <username>

21 Verifying CHAP Authentication» Verification command Router# show users Router# debug ppp negotiations» Note: Upon successful authentication, a CHAP server should show the users with IP addresses who are authenticated

22 Authentication Debug Mar Ser1/1 PPP Phase is AUTHENTICATING, by both *Mar Ser1/1 CHAP O CHALLENGE id 5 len 28 from "isdn2-2" *Mar Ser1/1 CHAP I CHALLENGE id 5 len 28 from "isdn2-3" *Mar Ser1/1 CHAP O RESPONSE id 5 len 28 from "isdn2-2" *Mar Ser1/1 CHAP I SUCCESS id 5 len 4 *Mar Ser1/1 CHAP I RESPONSE id 5 len 28 from "isdn2-3" *Mar Ser1/1 CHAP O SUCCESS id 5 len 4 *Mar Ser1/1 PPP Phase is UP

23 Things to Look for in PPP debug» LCP: State is open LCP negotiation was successful If not, then look for options that failed» Authentication: PAP or CHAP Check for username, passwords, etc» NCP: IPCP, IPXCP, ATCP state is open Means NCP negotiation was successful If not, then look for confreq, confrej, confack, confnack, etc

24 Layer-3 Address Negotiation Router (client) Sally (server) Ser0/0/0 Ser1/1/1 Hostname Chris Username Sally password Cisco interface serial 0/0/0 ip address negotiated encapsulation ppp Hostname Sally username Chris password Cisco interface serial 1/1/1 ip address encapsulation ppp ppp authentication chap peer default ip address pool MyPool ip local pool MyPool

25 Quiz» Which of the following items are negotiated during the PPP LCP stage? A. Multilink B. Authentication Type C. Authentication Challenge D. Callback E. IP address

26 Quiz» Which PPP LCP option would you look for in the output of debug ppp negotiations to indicate that PPP Multilink had been configured? MRU MRRU ACCM Magic Number

27 Quiz» Router-1 sends a PPP LCP frame indicating that it wishes to implement CHAP authentication.» Router-2, at the other end of the PPP link, is not configured for CHAP but is configured for PAP.» In response to Router-1 s Conf-Req packet Router-2 will send a indicat ing t hat it want s t o do PAP. Conf-REJ Conf-NAK Conf-ACK Conf-REQ

28 Quiz Based on the configurations shown below, will a successful PPP connection be established between these two routers? If not, why not? Router (client) Sally (server) Ser0/0/0 Ser1/1/1 Hostname Router username Sally password Cisco interface serial 0/0/0 ip address encapsulation ppp ppp authentication pap ppp pap sent-username Router password Cisco Hostname Sally username Chris password Cisco interface serial 1/1/1 ip address encapsulation ppp ppp authentication pap ppp chap hostname Sally ppp chap password Cisco

29 Quiz» What can you infer from the following debug output?

30 Quiz» A troubleticket is opened because it has been discovered that ICMP pings to are not able to flow across a PPP connection on Router-3.» Based on the debug output below, what is the root cause of this problem?

31 PPPoE (PPP over Ethernet)

32 Why do we need PPPoE?» Original objective for PPP was to support: A single, dialup host Temporary network connection» With the advent of DSL and Metro Ethernet, new problems were presented: How to allow a single, DSL connection to support an entire LAN of PPP clients? Differentiate traffic from multiple companies sharing a common Ethernet connection to an ISP

33 PPPoE, Common Use-Case Company-A Company-B PPPoE Client Only customers with correct/unique PPPoE Authentication credentials gain ISP access. ISP can track individual PPPoE sessions for billing purposes. Company-C PPPoE Client PPPoE Client Internet ISP Company-D PPPoE Client Metro Ethernet

34 PPPoE Control Packets» Normal PPP across WAN lines starts immediately with LCP.» PPPoE prefaces LCP with special PPPoE Control packets to establish a unique Session-ID.» Session-ID is used by ISP to indentify individual customers.

35 PPPoE Active Discovery» PPPoE based on Client/Server architecture. Multiple clients on a single, shared medium One server terminating/aggregating multiple clients.» PPPoE relies on Active Discovery frames to enable Clients to discover Server and obtain unique Session-ID.» Active Discovery process (and names of Control Frames) has many similarities to DHCP process.

36 PPP Active Discovery Process Are there any PPPoE Servers out there? My unique Host-ID is xx-xx PADI (PPPoE Active Discovery Initialization) L2 Ethernet Destination = Broadcast 1 2 Yes, I m here xx-xx. My unique Access Concentrator (AC) ID is yy.yy PADO (PPPoE Active Discovery Offer) L2 Ethernet Destination = Unicast Thanks for that info Can I have a Session-ID please? PADR (PPPoE Active Discovery Request) L2 Ethernet Destination = Unicast 3 4 Yes, let s use Session-ID 0x02. PADS (PPPoE Active Discovery Session-Confirmation) L2 Ethernet Destination = Unicast PPPoE Server MAC = yy:yy:yy:yy:yy:yy PPPoE Client MAC = xx:xx:xx:xx:xx:xx

37 PPP Encapsulation within Ethernet PPP General Frame Format PPP Control, or Start Flag Address Control Protocol Padding FCS Final Flag Encapsulated Data Dest Mac Source Mac 0x8863 0x8864 Ethertype Protocol PPP Control, or Encapsulated Data PPPoE Ethernet General Frame Format Ethernet FCS

38 Configuring PPPoE Fast0/0 hostname server username client password cisco bba-group pppoe INE virtual-template 1 interface Virtual-Template1 ip address or ip unnumbered loopback 0 peer default ip address pool MyPool ppp authentication chap ip local pool MyPool interface FastEthernet0/0 no ip address duplex auto speed auto Copyright pppoe enable group INE Fast0/0 hostname client interface Dialer1 ip address negotiated encapsulation ppp dialer pool 1 ppp chap password 0 cisco interface FastEthernet0/0 no ip address duplex auto speed auto pppoe-client dial-pool-number 1

39 Configuring PPPoE with DHCP DHCP Server Fast0/0 hostname server username client password cisco bba-group pppoe INE virtual-template 1 interface Virtual-Template1 ip address peer default ip address dhcp ppp authentication chap ip helper-address interface FastEthernet0/0 no ip address duplex auto speed auto pppoe enable group INE Fast0/0 hostname client interface Dialer1 ip address dhcp encapsulation ppp dialer pool 1 ppp chap password 0 cisco interface FastEthernet0/0 no ip address duplex auto speed auto pppoe-client dial-pool-number 1

40 Verifying PPPoE on Server (1) (PTA) PPP Termination Aggregation

41 Verifying PPPoE on Server (2)

42 Verifying PPPoE on Client (1)

43 Verifying PPPoE on Client (2)

44 PPPoE and MTU» PPP = 8-bytes of overhead (headers)» Max-sized Ethernet frame (data) = 1500-bytes» 1500-bytes + 8-bytes (PPP) = 1508» 1508-bytes + 14-bytes (Ethernet headers) = 1522-bytes» Every maximum-sized Ethernet frame sent from hosts will need to be fragmented by PPPoE-speaking routers.» Fragmentation = CPU-intensive

45 MTU and Virtual-interfaces» Virtual-Templates (and Dialer-Interfaces) spawn Virtual- Access interfaces for terminating PPPoE session.» Virtual-Access interfaces spawned from Virtual-Templates (using PPPoE) have default MTU=1492» Virtual-Access interfaces spawned from Dialer-Interfaces have default MTU=1500» What are the results of mismatched MTU? Frequent fragmentation of large Ethernet frames OSPF peering stuck in EXSTART state.

46 Fixing MTU Mismatches PPPoE Server Fast0/0 Fast0/0 PPPoE Client Fast1/1 Web Server hostname server username client password cisco bba-group pppoe INE virtual-template 1 interface Virtual-Template1 ip address peer default ip address dhcp ppp authentication chap ip helper-address interface FastEthernet0/0 no ip address duplex auto speed auto pppoe enable group INE hostname client interface Dialer1 ip address dhcp encapsulation ppp dialer pool 1 ppp chap password 0 cisco ip mtu 1492 interface FastEthernet0/0 no ip address duplex auto speed auto pppoe-client dial-pool-number 1 Interface FastEthernet1/1 ip address x.x.x.x y.y.y.y ip tcp adjust-mss 1452

47 Q&A Copyright INE Inc. All rights reserved.