综合数字业务网（ISDN）由数字电话和数据传输服务两部分组成，一般由电话局提供这种服务。ISDN的基本速率接口（BRI）服务提供2个B信道和1个D信道（2B+D）。BRI的B信道速率为64Kbps,用于传输用户数据。D信道的速率为16Kbps，主要传输控制信号。在北美和日本，ISDN的主速率接口（PRI）提供23个B信道和1个D信道，总速率可达1.544Mbps，其中D信道速率为64Kbps。而在欧洲、澳大利亚等国家，ISDN的PRI提供30个B信道和1个64Kbps D信道，总速率可达2.048Mbps。我国电话局所提供ISDN PRI为30B+D。
|
任务 |
命令 |
|
设置ISDN交换类型 |
isdn switch-type switch-type1 |
|
接口设置 |
interface bri 0 |
|
设置PPP封装 |
encapsulation ppp |
|
设置协议地址与电话号码的映射 |
dialer map protocol next-hop-address [name hostname] [broadcast] [dial-string] |
|
启动PPP多连接 |
ppp multilink |
|
设置启动另一个B通道的阈值 |
dialer load-threshold load |
|
显示ISDN有关信息 |
show isdn {active | history | memory | services | status [dsl | interface-type number] | timers} |
注：1.交换机类型如下表,国内交换机一般为basic-net3。
|
按区域分关键字 |
交换机类型 |
|
Australia |
|
|
basic-ts013 |
Australian TS013 switches |
|
Europe |
|
|
basic-1tr6 |
German 1TR6 ISDN switches |
|
basic-nwnet3 |
Norway NET3 switches (phase 1) |
|
basic-net3 |
NET3 ISDN switches (UK, Denmark, and other nations); covers the Euro-ISDN E-DSS1 signalling system |
|
primary-net5 |
NET5 switches (UK and Europe) |
|
vn2 |
French VN2 ISDN switches |
|
vn3 |
French VN3 ISDN switches |
|
Japan |
|
|
ntt |
Japanese NTT ISDN switches |
|
primary-ntt |
Japanese ISDN PRI switches |
|
North America |
|
|
basic-5ess |
AT&T basic rate switches |
|
basic-dms100 |
NT DMS-100 basic rate switches |
|
basic-ni1 |
National ISDN-1 switches |
|
primary-4ess |
AT&T 4ESS switch type for the U.S. (ISDN PRI only) |
|
primary-5ess |
AT&T 5ESS switch type for the U.S. (ISDN PRI only) |
|
primary-dms100 |
NT DMS-100 switch type for the U.S. (ISDN PRI only) |
|
New Zealand |
|
|
basic-nznet3 |
New Zealand Net3 switches |
3. ISDN实现DDR（dial-on-demand routing）实例:
设置如下：Router1:
hostname router1
user router2 password cisco
!
isdn switch-type basic-net3
!
interface bri 0
ip address 192.200.10.1 255.255.255.0
encapsulation ppp
dialer map ip 192.200.10.2 name router2 572
dialer load-threshold 80
ppp multilink
dialer-group 1
ppp authentication chap
！
dialer-list 1 protocol ip permit
!
Router2:
hostname router2
user router1 password cisco
!
isdn switch-type basic-net3
!
interface bri 0
ip address 192.200.10.2 255.255.255.0
encapsulation ppp
dialer map ip 192.200.10.1 name router1 571
dialer load-threshold 80
ppp multilink
dialer-group 1
ppp authentication chap
！
dialer-list 1 protocol ip permit
!
Cisco路由器同时支持回拨功能，我们将路由器Router1作为Callback Server,Router2作为Callback Client。
与回拨相关命令:
|
任务 |
命令 |
|
映射协议地址和电话号码，并在接口上使用在全局模式下定义的PPP回拨的映射类别。 |
dialer map protocol address name hostname class classname dial-string |
|
设置接口支持PPP回拨 |
ppp callback accept |
|
在全局模式下为PPP回拨设置映射类别 |
map-class dialer classname |
|
通过查找注册在dialer map里的主机名来决定回拨. |
dialer callback-server [username] |
|
设置接口要求PPP回拨 |
ppp callback request |
设置如下：
Router1:
hostname router1
user router2 password cisco
!
isdn switch-type basic-net3
!
interface bri 0
ip address 192.200.10.1 255.255.255.0
encapsulation ppp
dialer map ip 192.200.10.2 name router2 class s3 572
dialer load-threshold 80
ppp callback accept
ppp multilink
dialer-group 1
ppp authentication chap
！
map-class dialer s3
dialer callback-server username
dialer-list 1 protocol ip permit
!
Router2:
hostname router2
user router1 password cisco
!
isdn switch-type basic-net3
!
interface bri 0
ip address 192.200.10.2 255.255.255.0
encapsulation ppp
dialer map ip 192.200.10.1 name router1 571
dialer load-threshold 80
ppp callback request
ppp multilink
dialer-group 1
ppp authentication chap
！
dialer-list 1 protocol ip permit
!
相关调试命令：
debug dialer
debug isdn event
debug isdn q921
debug isdn q931
debug ppp authentication
debug ppp error
debug ppp negotiation
debug ppp packet
show dialer
show isdn status
举例:执行debug dialer命令观察router2呼叫router1,router1回拨router2的过程.
router1#debug dialer
router2#ping 192.200.10.1
router1#
00:03:50: %LINK-3-UPDOWN: Interface BRI0:1, changed state to up
00:03:50: BRI0:1:PPP callback Callback server starting to router2 572
00:03:50: BRI0:1: disconnecting call
00:03:50: %LINK-3-UPDOWN: Interface BRI0:1, changed state to down
00:03:50: BRI0:1: disconnecting call
00:03:50: BRI0:1: disconnecting call
00:03:51: %LINK-3-UPDOWN: Interface BRI0:2, changed state to up
00:03:52: callback to router2 already started
00:03:52: BRI0:2: disconnecting call
00:03:52: %LINK-3-UPDOWN: Interface BRI0:2, changed state to down
00:03:52: BRI0:2: disconnecting call
00:03:52: BRI0:2: disconnecting call
00:04:05: : Callback timer expired
00:04:05: BRI0:beginning callback to router2 572
00:04:05: BRI0: Attempting to dial 572
00:04:05: Freeing callback to router2 572
00:04:05: %LINK-3-UPDOWN: Interface BRI0:1, changed state to up
00:04:05: BRI0:1: No callback negotiated
00:04:05: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
00:04:05: dialer Protocol up for Vi1
00:04:06: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changed state
to up
00:04:06: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, chang
ed state to up
00:04:11: %ISDN-6-CONNECT: Interface BRI0:1 is now connected to 572
#router1
本地局部网地址为10.0.0.0/24,属于保留地址，通过NAT地址翻译功能，局域网用户可以通过ISDN上263网访问Internet。263的ISDN电话号码为2633，用户为263，口令为263，所涉及的命令如下表：
|
任务 |
命令 |
|
指定接口通过PPP/IPCP地址协商获得IP地址 |
ip address negotiated |
|
指定内部和外部端口 |
ip nat {inside | outside} |
|
使用ppp/pap作认证 |
ppp authentication pap callin |
|
指定接口属于拨号组1 |
dialer-group 1 |
|
定义拨号组1允许所有IP协议 |
dialer-list 1 protocol ip permit |
|
设定拨号，号码为2633 |
dialer string 2633 |
|
设定登录263的用户名和口令 |
ppp pap sent-username 263 password 263 |
|
设定默认路由 |
ip route 0.0.0.0 0.0.0.0 bri 0 |
|
设定符合访问列表2的所有源地址被翻译为bri 0所拥有的地址 |
ip nat inside source list 2 interface bri 0 overload |
|
设定访问列表2，允许所有协议 |
access-list 2 permit any |
具体配置如下：
hostname Cisco2503
!
isdn switch-type basic-net3
!
ip subnet-zero
no ip domain-lookup
ip routing
!
interface Ethernet 0
ip address 10.0.0.1 255.255.255.0
no shutdown
!
interface Serial 0
shutdown
no description
no ip address
!
interface Serial 1
shutdown
no description
no ip address
!
interface bri 0
ip address negotiated
encapsulation ppp
ppp authentication pap callin
ppp multilink
dialer-group 1
dialer hold-queue 10
dialer string 2633
dialer idle-timeout 120
ppp pap sent-username 263 password 263
no cdp enable
no ip split-horizon
no shutdown
!
ip classless
!
! Static Routes
!
ip route 0.0.0.0 0.0.0.0 bri 0
!
! Access Control List 2
!
access-list 2 permit any
!
dialer-list 1 protocol ip permit
!
! Dynamic NAT
!
ip nat inside source list 2 interface bri 0 overload
snmp-server community public ro
!
line console 0
exec-timeout 0 0
!
line vty 0 4
!
end
由于Cisco765的设置命令与我们常用的Cisco路由器的命令不同，所以以下列举了通过Cisco765上263访问Internet的具体命令行设置步骤。
>set system c765
c765> set multidestination on
c765> set switch net3
c765> set ppp multilink on
c765> cd lan
c765:LAN> set ip routing on
c765:LAN> set ip address 10.0.0.1
c765:LAN> set ip netmask 255.0.0.0
c765:LAN> set briding off
c765:LAN>cd
c765> set user remotenet
New user remotenet being created
c765:remotenet> set ip routing on
c765:remotenet> set bridging off
c765:remotenet> set ip framing none
c765:remotenet> set ppp clientname 263
c765:remotenet> set ppp password client
Enter new Password: 263
Re-Type new Password: 263
c765:remotenet> set ppp authentication out none
c765:remotenet> set ip address 0.0.0.0
c765:remotenet> set ip netmask 0.0.0.0
c765:remotenet> set ppp address negotiation local on
c765:remotenet> set ip pat on
c765:remotenet> set ip route destination 0.0.0.0/0 gateway 0.0.0.0
c765:remotenet> set number 2633
c765:remotenet> set active
命令描述如下：
|
任务 |
命令 |
|
设置路由器系统名称 |
set system c765 |
|
允许路由器呼叫多个目的地 |
|
|
设置ISDN交换机类型为NET3 |
set switch net3 |
|
允许点到点间多条通道连接实现负载均衡 |
set ppp multilink on |
|
关掉桥接 |
set briding off |
|
建立用户预制文件用于设置拨号连接参数- 可以设置多个用户预制文件用于相同的物理端口对应于不同的连接。 |
set user remotenet |
|
使用PPP/IPCP |
set ip framing none |
|
设置上网用户帐号 |
set ppp clientname 263 |
|
设置上网口令 |
set ppp password client
Enter new Password: 263
Re-Type new Password: 263 |
|
不用PPP/CHAP或PAP做认证 |
set ppp authentication out none |
|
允许地址磋商 |
set ppp address negotiation local on |
|
设置地址翻译 |
set ip pat on |
|
设置默认路由 |
set ip route destination 0.0.0.0/0 gateway 0.0.0.0 |
|
设置ISP的电话号码 |
set number 2633 |
|
激活用户预制文件 |
set active |
六、
PSTN
电话网络(PSTN)是目前普及程度最高、成本最低的公用通讯网络，它在网络互连中也有广泛的应用。电话网络的应用一般可分为两种类型，一种是同等级别机构之间以按需拨号(DDR)的方式实现互连，一种是ISP为拨号上网为用户提供的远程访问服务的功能。
1. 远程访问
1.1.Access Server基本设置：
选用Cisco2511作为访问服务器,采用IP地址池动态分配地址.远程工作站使用WIN95拨号网络实现连接。
全局设置：
|
任务 |
命令 |
|
设置用户名和密码 |
username username password password |
|
设置用户的IP地址池 |
ip local pool {default | pool-name low-ip-address [high-ip-address]} |
|
指定地址池的工作方式 |
ip address-pool [dhcp-proxy-client | local] |
基本接口设置命令：
|
任务 |
命令 |
|
设置封装形式为PPP |
encapsulation ppp |
|
启动异步口的路由功能 |
async default routing |
|
设置异步口的PPP工作方式 |
async mode {dedicated | interactive} |
|
设置用户的IP地址 |
peer default ip address {ip-address | dhcp | pool [pool-name]} |
|
设置IP地址与Ethernet0相同 |
ip unnumbered ethernet0 |
line拨号线设置：
|
任务 |
命令 |
|
设置modem的工作方式 |
modem {inout|dialin} |
|
自动配置modem类型 |
modem autoconfig discovery |
|
设置拨号线的通讯速率 |
speed speed |
|
设置通讯线路的流控方式 |
flowcontrol {none | software [lock] [in | out] | hardware [in | out]} |
|
连通后自动执行命令 |
autocommand command |
访问服务器设置如下：
Router:
hostname Router
enable secret 5 $1$EFqU$tYLJLrynNUKzE4bx6fmH//
!
interface Ethernet0
ip address 10.111.4.20 255.255.255.0
!
interface Async1
ip unnumbered Ethernet0
encapsulation ppp
keepalive 10
async mode interactive
peer default ip address pool Cisco2511-Group-142
!
ip local pool Cisco2511-Group-142 10.111.4.21 10.111.4.36
!
line con 0
exec-timeout 0 0
password cisco
!
line 1 16
modem InOut
modem autoconfigure discovery
flowcontrol hardware
!
line aux 0
transport input all
line vty 0 4
password cisco
!
end
相关调试命令：
show interface
show line
1.2. Access Server通过Tacacs服务器实现安全认证：
使用一台WINDOWS NT服务器作为Tacacs服务器，地址为10.111.4.2,运行Cisco2511随机带的Easy ACS 1.0软件实现用户认证功能.
相关设置：
|
任务 |
命令 |
|
激活AAA访问控制 |
aaa new-model |
|
用户登录时默认起用Tacacs+做AAA认证 |
aaa authentication login default tacacs+ |
|
列表名为no_tacacs使用ENABLE口令做认证 |
aaa authentication login no_tacacs enable |
|
在运行PPP的串行线上采用Tacacs+做认证 |
aaa authentication ppp default tacacs+ |
|
由TACACS+服务器授权运行EXEC |
aaa authorization exec tacacs+ |
|
由TACACS+服务器授权与网络相关的服务请求。 |
aaa authorization network tacacs+ |
|
为EXEC会话运行记帐.进程开始和结束时发通告给TACACS+服务器。 |
aaa accounting exec start-stop tacacs+ |
|
为与网络相关的服务需求运行记帐包括SLIP,PPP,PPP NCPs,ARAP等.在进程开始和结束时发通告给TACACS+服务器。 |
aaa accounting network start-stop tacacs+ |
|
指定Tacacs服务器地址 |
tacacs-server host 10.111.4.2 |
|
在Tacacs+服务器和访问服务器设定共享的关键字，访问服务器和Tacacs+服务器使用这个关键字去加密口令和响应信息。这里使用tac作为关键字。 |
tacacs-server key tac |
访问服务器设置如下：
hostname router
!
aaa new-model
aaa authentication login default tacacs+
aaa authentication login no_tacacs enable
aaa authentication ppp default tacacs+
aaa authorization exec tacacs+
aaa authorization network tacacs+
aaa accounting exec start-stop tacacs+
aaa accounting network start-stop tacacs+
enable secret 5 $1$kN4g$CvS4d2.rJzWntCnn/0hvE0
!
interface Ethernet0
ip address 10.111.4.20 255.255.255.0
!
interface Serial0
no ip address
shutdown
interface Serial1
no ip address
shutdown
!
interface Group-Async1
ip unnumbered Ethernet0
encapsulation ppp
async mode interactive
peer default ip address pool Cisco2511-Group-142
no cdp enable
group-range 1 16
!
ip local pool Cisco2511-Group-142 10.111.4.21 10.111.4.36
tacacs-server host 10.111.4.2
tacacs-server key tac
!
line con 0
exec-timeout 0 0
password cisco
login authentication no_tacacs
line 1 16
login authentication tacacs
modem InOut
modem autoconfigure type usr_courier
autocommand ppp
transport input all
stopbits 1
rxspeed 115200
txspeed 115200
flowcontrol hardware
line aux 0
transport input all
line vty 0 4
password cisco
!
end
2. DDR（dial-on-demand routing）实例
此例通过Cisco 2500系列路由器的aux端口实现异步拨号DDR连接。Router1拨号连接到Router2。其中采用PPP/CHAP做安全认证，在Router1中应建立一个用户，以对端路由器主机名作为用户名，即用户名应为Router2。同时在Router2中应建立一个用户，以对端路由器主机名作为用户名，即用户名应为Router1。所建的这两用户的password必须相同。
相关命令如下：
|
任务 |
命令 |
|
设置路由器与modem的接口指令 |
chat-script script-name EXPECT SEND EXPECT SEND (etc.) |
|
设置端口在挂断前的等待时间 |
dialer idle-timeout seconds |
|
设置协议地址与电话号码的映射 |
dialer map protocol next-hop-address [name hostname] [broadcast] [modem-script
modem-regexp] [system-script system-regexp] [dial-string]
|
|
设置电话号码 |
dialer string dial-string |
|
指定在特定线路下路由器默认 使用的chat-script |
script {dialer|reset} script-name |
Router1:
hostname Router1
!
enable secret 5 $1$QKI7$wXjpFqC74vDAyKBUMallw/
!
username Router2 password cisco
chat-script cisco-default "" "AT" TIMEOUT 30 OK "ATDT \T" TIMEOUT 30 CONNECT \c
!
interface Ethernet0
ip address 10.0.0.1 255.255.255.0
!
interface Async1
ip address 192.200.10.1 255.255.255.0
encapsulation ppp
async default routing
async mode dedicated
dialer in-band
dialer idle-timeout 60
dialer map ip 192.200.10.2 name Router2 modem-script cisco-default 573
dialer-group 1
ppp authentication chap
!
ip route 10.0.1.0 255.255.255.0 192.200.10.2
dialer-list 1 protocol ip permit
!
line con 0
line aux 0
modem InOut
modem autoconfigure discovery
flowcontrol hardware
Router2:
hostname Router2
!
enable secret 5 $1$F6EV$5U8puzNt2/o9g.t56PXHo.
!
username Router1 password cisco
!
interface Ethernet0
ip address 10.0.1.1 255.255.255.0
!
interface Async1
ip address 192.200.10.2 255.255.255.0
encapsulation ppp
async default routing
async mode dedicated
dialer in-band
dialer idle-timeout 60
dialer map ip 192.200.10.1 name Router1
dialer-group 1
