Tài liệu DDR Lab Scenario 2 - Dialer Profiles with Authentication pdf

CertificationZone Page 1 of 9
/?Issue=32&IssueDate=03-01-2001&CP= 11/06/01
Date of Issue: 03-01-2001
Lab Scenario 2 - Dialer Profiles with
Authentication
by David Wolsefer
Introduction
Network Specifications
The Starting Configurations
Configure Global Commands
1. Configure the ISDN switch type on each router
2. No shut the BRI interfaces
3. Configure the Username Password Database
4. Define Interesting Traffic Using Dialer Lists
5. Configure the Rip version 2 routing protocol
Configure Physical Interface Commands
1. Enable encapsulation PPP
2. Specify ppp authentication chap
3. Configure SPIDs (If Necessary)
4. Assign the physical BRI interface to a dialer pool
Configure Logical Dialer Interface Commands
1. Create the logical dialer interface
2. Assign an IP address to the dialer interface
3. Enable PPP Encapsulation
4. Configure the Dialer Interface for PPP Authentication CHAP
5. Apply the dialer-list to define interesting traffic
6. Specify which dialer-pool to use
7. Configure the dialer remote name and string
8. Check our work
SOLUTION REVEALED
Router1's Final Configuration

Router2's Final Configuration
Introduction
This lab is designed to walk you through a basic dialer profile configuration and the special requirements this places
on PPP CHAP authentication. This lab will show you what commands to type in and how to check that you have
configured things correctly step by step. Some of the steps that were covered in great detail in the first lab scenario
will not be covered as thoroughly in this scenario, so refer to the first lab as needed.
Network Specifications
When you are finished building this network, it should meet the following specifications:
1. Each router should be able to dial the other using dialer profiles.
2. Each dialer interface should use PPP CHAP authentication. You should use the names CCNA1 and CCNA2
rather than the router host names router1 and router2 respectively. Use the password cisco.
3. You should only be able to see the neighboring router with Cisco Discovery Protocol if the ISDN link is already
up.
4. Configure routing using RIP version 2 so that each router can see the other router's Ethernet subnets. Note
that this will cause your ISDN connections to come up every 30 seconds to transmit the RIP routing tables.
This illustrates one of the problems with dynamic routing protocols such as RIP and IGRP when used with
DDR. Fixing this problem using techniques other than static routes is possible, but beyond the scope of the
CCNA exam.
The Starting Configurations
CertificationZone Page 2 of 9
/?Issue=32&IssueDate=03-01-2001&CP= 11/06/01
The equipment that I used in developing this lab included a Cisco 1604 router, and a Cisco 2610 router. The ISDN
simulator was a Teltone ISDN Demonstrator with two U interfaces. You will need to adjust the lab contents to fit your
ISDN simulator and/or routers as necessary. You MUST use an ISDN simulator or actual ISDN lines. There is no way
to configure ISDN using crossover cables or something similar. You can use any router with suitable ISDN interfaces,
but be aware of whether you have U interfaces or S/T interfaces. If you have S/T interfaces, then you will need an
NT1. Here is the basic starting point for cabling your equipment:
(The following information will vary depending upon your ISDN simulator or actual ISDN lines)
ISDN Information for Router1:
isdn switch-type basic-ni

isdn spid1 0835866101 8358661
isdn spid2 0835866301 8358663
ISDN Information for router2:
isdn switch-type basic-ni
isdn spid1 0835866201 8358662
isdn spid2 0835866401 8358664
Figure 1.
Configure Global Commands
1. Configure the ISDN switch type on each router
Before we begin, perform a write erase on each router to make sure that we are starting from scratch. After you enter
the write erase command, reload the router. When you receive a prompt to configure the router, enter ctrl-c and the
router will continue to boot up.
Once this is complete, check that no configuration exists by entering the write command followed by show
configuration. (Note: you can use show configuration instead of show run because you just saved the
configuration. This displays the current configuration faster than show run would.) You should not see any configured
IP addresses, routing statements, or ISDN configurations of any kind. Enter the IP addresses for the Ethernet
interfaces, no shut them, and use the no keep-alive command, if necessary, in case you don't have the Ethernet
interfaces plugged into a hub or switch.
Since we have no ISDN switch type configured, our first step should be to configure the ISDN switch type. We can
use the ? to help us find the correct syntax for our switch type, basic-ni1. We will need to use the isdn switch-type
global command on each router as follows:
Router1#
Router1#configure terminal (you can use conf t for short)
Router1(config)#
router1(config)#isdn switch-type ?
basic-1tr6 1TR6 switch type for Germany
basic-5ess AT&T 5ESS switch type for the U.S.
basic-dms100 Northern DMS-100 switch type
basic-net3 NET3 switch type for UK and Europe
basic-ni1 National ISDN-1 switch type

basic-nwnet3 NET3 switch type for Norway
basic-nznet3 NET3 switch type for New Zealand
CertificationZone Page 3 of 9
/?Issue=32&IssueDate=03-01-2001&CP= 11/06/01
basic-ts013 TS013 switch type for Australia
ntt NTT switch type for Japan
vn2 VN2 switch type for France
vn3 VN3 and VN4 switch types for France
router1(config)#isdn switch-type basic-ni1
router1(config)#^Z
router1#
00:23:38: %SYS-5-CONFIG_I: Configured from console by console
Now that we have configured the ISDN switch type, let's check it using the show isdn status command. If you
configured your routers correctly, you should see the following:
Router1#sh isdn stat
The current ISDN Switchtype = basic-ni1
ISDN BRI0 interface
Layer 1 Status:
DEACTIVATED
Layer 2 Status:
Layer 2 NOT Activated
Layer 3 Status:
0 Active Layer 3 Call(s)
Activated dsl 0 CCBs = 0
The Free Channel Mask: 0x80000003
Total Allocated ISDN CCBs = 0
2. No shut the BRI interfaces
No shut the BRI interfaces to make sure that each router is talking to the ISDN switch:
Router1(config)#int bri 0
Router1(config-if)#no shut

Router1(config-if)#^z
00:23:54: %LINK-3-UPDOWN: Interface BRI0:1, changed state to down
00:23:54: %LINK-3-UPDOWN: Interface BRI0:2, changed state to down
00:23:54: %LINK-3-UPDOWN: Interface BRI0, changed state to up
Although we are no shutting the physical interface, we are doing it only to check that the global command for the
ISDN switch type is correct. Once we no shut the BRI interface, we should see it come up. Check that the router is
communicating with the ISDN switch by examining the layer 1 status to make sure it is ACTIVE and checking the
layer 2 status to make sure it reads MULTIPLE FRAME ESTABLISHED. Here is what you will look see:
router#sh isdn stat
The current ISDN Switchtype = basic-ni1
ISDN BRI0 interface
Layer 1 Status:
ACTIVE
Layer 2 Status:
TEI = 70, State = MULTIPLE_FRAME_ESTABLISHED
Layer 3 Status:
No Active Layer 3 Call(s)
Activated dsl 0 CCBs = 0
Total Allocated ISDN CCBs = 0
We now know that we have correctly defined the ISDN switch type and that our router is talking to the ISDN switch on
the D channel. The next step is to configure the user password database so we can use this information for
authentication.
3. Configure the Username Password Database
The first step in configuring CHAP authentication is to set up local user databases on each router. What we need to
do is to enter the username for the opposite router and a common password using a global configuration command.
Since the instructions specified that we should use the usernames CCNA1 and CCNA2 instead of the router
hostnames we used in Lab 1, we need to configure the correct usernames. Don't forget that the passwords are case
sensitive. For example, on router1, we would enter the following:
Router1(config)#username CCNA2 password cisco
CertificationZone Page 4 of 9

/?Issue=32&IssueDate=03-01-2001&CP= 11/06/01
On router2, we would similarly enter:
Router2(config)#username CCNA1 password cisco
The next step in our configuration is to define interesting traffic.
4. Define Interesting Traffic Using Dialer Lists
A dialer-list is used to define "interesting traffic" (traffic for which you wish to bring up the ISDN connection). We
define a dialer-list in global configuration mode then apply the dialer-list using an interface configuration command
dialer-group. When I am configuring ISDN DDR, I like to first define my dialer lists very broadly using IP until I have
all features working, such as call setup and teardown, authentication, callback, etc. Once I have basic features
working correctly, then I will make the dialer list more selective, if necessary, using an access-list. Here is an example
that shows how traffic can be defined as interesting using a broad dialer list:
Router1(config)#dialer-list 1 protocol ?
Appletalk Appletalk
Bridge Bridging
Clns OSI Connectionless Area Services
Clns_es CLNS End System
Clns_is CLNS Intermediate System
Decnet DECnet
Decnet DECnet node
Decnet_router-L1 DECnet router L1
Decnet_router-L2 DECnet router L2
Ip IP
Ipx Novell IPX
Llc2 LLC2
Vines Banyan Vines
Xns XNS
Using the above syntax, the first dialer list I like to configure is
Router1(config)#dialer-list 1 protocol ip permit
We will cover applying the dialer-list later when we cover the dialer interface commands. For now, our next task is to
configure our routing protocol, RIP Version 2.

5. Configure the Rip version 2 routing protocol
Configuring RIP is very simple, but we need to be aware of the differences between Version 1 and Version 2. Can you
remember them off the top of your head? The two major differences are 1) RIP version 1 is classful whereas RIP
version 2 is not, and 2) RIP version 2 supports VLSM. Another difference is that RIP version 2 supports route
authentication. We will not cover route authentication here, just be aware that it exists and should not be confused
with PPP authentication.
To configure RIP Version 2, all we have to do is enable the RIP routing process, define the participating networks,
and specify version 2. This will be done on each router as follows:
Router2(config)#router rip
Router2(config)#network 10.0.0.0
Router2(config)#network 172.19.0.0
Router2(config)#version 2
We can check that RIP version 2 is enabled using the show ip protocols command on each router. Now that we
have completed the global configuration commands, our next step is to configure the physical BRI interface. For our
final step, we will create and configure logical dialer interfaces.
Configure Physical Interface Commands
1. Enable encapsulation PPP
With dialer profiles, we must specify encapsulation PPP on both the physical BRI interface and the logical dialer
CertificationZone Page 5 of 9
/?Issue=32&IssueDate=03-01-2001&CP= 11/06/01
interface. Here is an example:
Router2(config)#interface bri 0
Router2(config-if)#encapsulation ppp
Since we are going to use PPP CHAP authentication, we must configure it, also, on both the physical and the logical
interfaces.
2. Specify ppp authentication chap
Router2(config)#interface bri 0
Router2(config-if)#ppp authentication chap
Although we are going to use dialer profiles, we still need to configure SPIDs under the physical BRI interface.
3. Configure SPIDs (If Necessary)

The example below shows how SPIDs are entered as well as how we can check that they are configured correctly.
Router2(config-if)#isdn spid1 ?
WORD spid1 string
Router2(config-if)#isdn spid1 0835866201 ?
WORD local directory number
<cr>
router2(config-if)#isdn spid1 0835866201 8358662
router2(config-if)#isdn spid2 0835866401 8358664
Now, let's look at an example where the SPIDs have been configured correctly, sent, and are valid. This will not occur
unless the router's configuration matches the configuration of the ISDN switch exactly.
Router2#sh isdn stat
The current ISDN Switchtype = basic-ni1
ISDN BRI0 interface
Layer 1 Status:
ACTIVE
Layer 2 Status:
TEI = 76, State = MULTIPLE_FRAME_ESTABLISHED
TEI = 77, State = MULTIPLE_FRAME_ESTABLISHED
Spid Status:
spid1 configured, spid1 sent, spid1 valid
spid2 configured, spid2 sent, spid2 valid
Layer 3 Status:
0 Active Layer 3 Call(s)
Activated dsl 0 CCBs = 0
4. Assign the physical BRI interface to a dialer pool
Since we are going to configure dialer profiles, our configuration differs at this point from legacy DDR. Because we
can create many logical dialer interfaces, but have a fixed number of physical BRI interfaces, we need a method to
assign the physical interface to the desired logical dialer interface. The reasons for this become clearer when you
think of a situation where you have only two physical BRI interfaces, but need to use four logical dialer interfaces to
connect other routers. The first BRI interface may be in use by one of the logical dialer interfaces when we need to

place an additional call. By defining both physical BRI interfaces as members of the same dialer pool, the next
available physical BRI interface will be dynamically bound to the logical dialer interface at the time of the call.
Before we configure the physical BRI interface for dialer profiles, we first need to remove all legacy DDR commands,
including dialer map statements, dialer group statements, and network layer addresses. This step should not be
necessary for this lab because we write erased the routers at the beginning of the lab. Here is an example of how we
assign the physical interface to a dialer pool. A physical interface can be assigned to multiple dialer pools, but a
logical dialer interface can only be assigned to a single dialer pool.
Router1(config)#interface bri 0
Router1(config-if)#dialer pool-member 1
Now that we have assigned the physical BRI interface to a dialer pool, we have completed the interface commands
CertificationZone Page 6 of 9
/?Issue=32&IssueDate=03-01-2001&CP= 11/06/01
for the physical BRI interface. The next step is to create a logical dialer interface.
Configure Logical Dialer Interface Commands
So far, the global and physical BRI interface commands have been relatively simple. The most complicated portion of
the overall configuration consists of the creation of the logical dialer interface and the more extensive commands
applied to it. Here is an overview of the remaining steps.
First, we need to create the logical dialer interface. Next, we need to associate a dialer pool with the dialer interface
using the dialer pool number command, where number is the same number previously used with the dialer pool-
member command. Next, we add a dialer-group statement to define interesting traffic and a dialer string to call.
Since we want to use alternate CHAP hostnames, we need to configure them using the ppp chap hostname
command. Finally, we add a dialer remote-name command to enable creation of a dynamic dialer map to the remote
router. We also need to repeat the encapsulation ppp and ppp authentication chap commands we used on the
physical BRI interface.
1. Create the logical dialer interface
To configure the logical dialer interface, we first need to create a logical dialer interface in the same way we create
other logical interfaces such as loopback interfaces.
Router1(config)#interface dialer 0
2. Assign an IP address to the dialer interface
Router1(config-if)#ip address 172.19.1.6 255.255.255.252

3. Enable PPP Encapsulation
Router1(config-if)#encapsulation ppp
4. Configure the Dialer Interface for PPP Authentication CHAP
To configure PPP CHAP authentication, we first need to use the same command we used under the physical BRI
interface. We then need to use a new command, ppp chap hostname, to specify the hostname we want to use for
authentication. This can be totally different from the router's own hostname and is, in our case, CCNA1 or CCNA2.
Here is an example:
Router1(config-if)#ppp authentication chap
Router1(config-if)#ppp chap hostname CCNA1
Next, we need to tell the logical dialer interface what dialer-list to use to define interesting traffic.
5. Apply the dialer-list to define interesting traffic
Since we are using dialer profiles, we need to apply the dialer list we created previously to the dialer interface, rather
then the physical BRI interface, using the dialer-group command:
Router1(config)#interface dialer0
Router1(config-if)#dialer-group 1
6. Specify which dialer-pool to use
Next, we need to tell the logical dialer interface which dialer pool to use. Although we can only specify a single dialer
pool to use under the logical dialer interface, the dialer pool can contain multiple physical BRI interfaces.
Router1(config)#interface dialer 0
Router1(config-if)#dialer pool 1
CertificationZone Page 7 of 9
/?Issue=32&IssueDate=03-01-2001&CP= 11/06/01
7. Configure the dialer remote name and string
Dialer profiles use dynamic dialer maps, which are created automatically at the time a call is placed, to dial the
remote router. We use a combination of a dialer string and dialer remote name to enable the creation of the dynamic
dialer maps.
Router1(config)#interface dialer0
Router1(config-if)#dialer remote-name router2
Router1(config-if)#dialer string 8358662
8. Check our work

At this point, our configuration is complete. We can now check our work by pinging from router1 to router2 and vice
versa.
router1#ping 172.19.1.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.19.1.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
SOLUTION REVEALED
Router1's Final Configuration
version 12.0
!
hostname router1
!
username CCNA2 password 0 cisco
!
ip subnet-zero
!
isdn switch-type basic-ni
!
interface Ethernet0/0
ip address 10.10.11.1 255.255.255.0
no ip directed-broadcast
!
interface Serial0/0
no ip address
shutdown
!
interface BRI0/0
encapsulation ppp
isdn switch-type basic-ni

isdn spid1 0835866101 8358661
isdn spid2 0835866301 8358663
ppp authentication chap
dialer pool-member 1
!
interface dialer 0
ip address 172.19.1.6 255.255.255.252
encapsulation ppp
dialer remote-name router2
dialer string 8358662
dialer pool 1
dialer-group 1
ppp authentication chap
ppp chap hostname CCNA1
!
ip classless
!
router rip
version 2
network 10.0.0.0
CertificationZone Page 8 of 9
/?Issue=32&IssueDate=03-01-2001&CP= 11/06/01
network 172.19.0.0
!
dialer-list 1 protocol ip permit
!
line con 0
transport input none
line aux 0
line vty 0 4

login
!
no scheduler allocate
end
router1#sh ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
U - per-user static route
Gateway of last resort is not set
10.0.0.0/8 is subnetted, 1 subnets
C 10.10.11.1 is directly connected, Ethernet0
R 10.10.12.0/24 [120/2] via 172.19.1.5, 00:02:46, BRI0/0
172.19.0.0/16 is subnetted, 1 subnets
C 172.19.1.4 is directly connected, BRI0/0
Router2's Final Configuration
version 12.0
!
hostname router2
!
username router1 password 0 cisco
!
ip subnet-zero
!
isdn switch-type basic-ni
!
interface Ethernet0/0
ip address 10.10.12.1 255.255.255.0
no ip directed-broadcast

!
interface Serial0/0
no ip address
shutdown
!
interface BRI0/0
encapsulation ppp
isdn switch-type basic-ni
isdn spid1 0835866001 8358660
isdn spid2 0835866201 8358662
ppp authentication chap
dialer pool-member 1
!
interface dialer 0
ip address 172.19.1.5 255.255.255.252
encapsulation ppp
dialer remote-name router1
dialer string 8358660
dialer pool 1
dialer-group 1
ppp authentication chap
ppp chap hostname CCNA2
!
ip classless
!
router rip
version 2
network 10.0.0.0
network 172.19.0.0
!

dialer-list 1 protocol ip permit
CertificationZone Page 9 of 9
/?Issue=32&IssueDate=03-01-2001&CP= 11/06/01
!
line con 0
transport input none
line aux 0
line vty 0 4
login
!
no scheduler allocate
end
Router2#sh ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
U - per-user static route
Gateway of last resort is not set
10.0.0.0/8 is subnetted, 1 subnets
C 10.10.12.1 is directly connected, Ethernet0
R 10.10.11.0/24 [120/2] via 172.19.1.6, 00:02:46, BRI0
172.19.0.0/16 is subnetted, 1 subnets
C 172.19.1.4 is directly connected, BRI0
[NA-DDR-LS2-F03]
[2001-02-23-01]
Copyright © 2001 Genium Publishing Corporation