OSPF實(shí)驗(yàn)5：OSPF認(rèn)證完整總結(jié)

1、本資料由-大學(xué)生創(chuàng)業(yè)|創(chuàng)業(yè)|創(chuàng)業(yè)網(wǎng)OSPF實(shí)驗(yàn)5：OSPF認(rèn)證完整總結(jié)實(shí)驗(yàn)等級(jí)：Expert實(shí)驗(yàn)拓?fù)洌?#160; 實(shí)驗(yàn)說明：OSPF的認(rèn)證有2種類型（確切說是3種），其中type0表示無認(rèn)證，type1表示明文認(rèn)證，type2表示MD5認(rèn)證。明文認(rèn)證發(fā)送密碼進(jìn)行認(rèn)證，而MD5認(rèn)證發(fā)送的是報(bào)文摘要。有關(guān)MD5的詳細(xì)信息，可以參閱RFC1321. OSPF的認(rèn)證可以在鏈路上進(jìn)行，也可以在整個(gè)區(qū)域內(nèi)進(jìn)行認(rèn)證。另外虛鏈路同樣也可以進(jìn)行認(rèn)證。實(shí)驗(yàn)基本配置：R1: interface Loopback0 ip address 1.1.1.1 255.255.255.0!interface Fa

2、stEthernet0/0 ip address 21.1.1.1 255.255.255.0 duplex half!router ospf 10 router-id 1.1.1.1 log-adjacency-changes network 10.1.1.0 0.0.0.255 area 0 network 21.1.1.0 0.0.0.255 area 0R2： interface Loopback0 ip address 2.2.2.2 255.255.255.0!interface FastEthernet0/0 ip address 21.1.1.2 255.255.255.0 d

3、uplex half!interface Serial1/0 ip address 10.1.1.2 255.255.255.0 serial restart-delay 0!interface Serial1/1 ip address 11.1.1.1 255.255.255.0 serial restart-delay 0!router ospf 10 router-id 2.2.2.2 log-adjacency-changes area 1 virtual-link 3.3.3.3 network 10.1.1.0 0.0.0.255 area 0 network 11.1.1.0 0

4、.0.0.255 area 1 network 21.1.1.0 0.0.0.255 area 0R3：interface Loopback0 ip address 3.3.3.3 255.255.255.0! interface Serial1/0 ip address 11.1.1.2 255.255.255.0 serial restart-delay 0!router ospf 10 router-id 3.3.3.3 log-adjacency-changes area 1 virtual-link 2.2.2.2 network 3.3.3.0 0.0.0.255 area 2 n

5、etwork 11.1.1.0 0.0.0.255 area 1認(rèn)證配置：1.       在R1和R2的串行鏈路上進(jìn)行OSPF明文認(rèn)證：首先先在R1上做如下配置，看在R1配置完認(rèn)證，R2還沒有配置認(rèn)證的時(shí)候的情況：R1(config)#int s1/0R1(config-if)#ip ospf authentication（啟用認(rèn)證）R1(config-if)#ip ospf authentication-key cisco（配置密碼）通過debug工具我們可以看到如下信息：*Aug 15 22:51:54.275: OSPF: R

6、cv pkt from 10.1.1.2, Serial1/0 : Mismatch Authentication type. Input packet specified type 0, we use type 1這里的type0是指對(duì)方?jīng)]有啟用認(rèn)證，type1是明文認(rèn)證。在R2上配置認(rèn)證，使得鄰居關(guān)系恢復(fù)。R2(config)#int s1/0R2(config-if)#ip ospf authenticationR2(config-if)#ip ospf authentication-key cisco*Aug 15 22:54:55.815: %OSPF-5-ADJCHG: Proce

7、ss 10, Nbr 1.1.1.1 on Serial1/0 from LOADING to FULL, Loading Done2.在R2和R3的串行鏈路上進(jìn)行MD5認(rèn)證的：R2(config)#int s1/1R2(config-if)#ip ospf authentication message-digest（定義認(rèn)證類型為MD5） R2(config-if)#ip ospf message-digest-key 1 md5 cisco（定義key和密碼）R3(config)#int s1/0R3(config-if)#ip ospf authentication message-di

8、gest R3(config-if)#ip ospf message-digest-key 1 md5 ciscoR3(config-if)#*Aug 15 22:59:44.175: %OSPF-5-ADJCHG: Process 10, Nbr 2.2.2.2 on Serial1/0 from LOADING to FULL, Loading DoneR3#show ip ospf int s1/0 Serial1/0 is up, line protocol is up Internet Address 11.1.1.2/24, Area 1 Process ID 10, Router

9、 ID 3.3.3.3, Network Type POINT_TO_POINT, Cost: 64 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:05 Index 1/1, flood queue length 1 Next 0x648352C8(13)/0x0(0) Last flood scan length is 1, m

10、aximum is 2 Last flood scan time is 0 msec, maximum is 0 msec Flood pacing timer due in 0 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 2.2.2.2 Suppress hello for 0 neighbor(s) Message digest authentication enabledYoungest key id is 13.修改R2和R3上串行鏈路的MD5認(rèn)證的密碼： 在R2原有的配置上

11、加上下面這條命令：R2(config-if)#ip ospf message-digest-key 2 md5 gairuheR2#sho ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface3.3.3.3 0 FULL/ - - 11.1.1.2 OSPF_VL01.1.1.1 1 FULL/BDR 00:00:34 21.1.1.1 FastEthernet0/01.1.1.1 0 FULL/ - 00:00:37 10.1.1.1 Serial1/03.3.3.3 0 FULL/ - 00:00:31 11.

12、1.1.2 Serial1/1我們發(fā)現(xiàn)鄰居關(guān)系沒有丟失。R2#show ip ospf interface s1/1Serial1/1 is up, line protocol is up Internet Address 11.1.1.1/24, Area 1 Process ID 10, Router ID 2.2.2.2, Network Type POINT_TO_POINT, Cost: 64 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wa

13、it 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:01 Index 1/3, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 1, maximum is 1 Last flood scan time is 4 msec, maximum is 4 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 3.3.3.3 Suppress hel

14、lo for 0 neighbor(s) Message digest authentication enabled Youngest key id is 2 Rollover in progress, 1 neighbor(s) using the old key(s): key id 1這里我們可以看到兩個(gè)key都在使用。所以要修改鏈路的MD5認(rèn)證的密碼時(shí)，可以先將新的密碼配置到啟用認(rèn)證的路由器后在將原來的密碼刪除，這樣的話可以保證在修改配置的時(shí)候鄰居關(guān)系依然存在。4.在Area0上進(jìn)行區(qū)域認(rèn)證 R1(config)#router ospf 10R1(config-router)#area

15、 0 authenticationR1(config-router)#*Aug 15 23:09:32.619: %OSPF-5-ADJCHG: Process 10, Nbr 2.2.2.2 on FastEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired發(fā)現(xiàn)快速以太網(wǎng)接口的鄰居已經(jīng)丟失。通過debug信息我們看到：R1#*Aug 15 23:10:32.619: OSPF: Rcv pkt from 21.1.1.2, FastEthernet0/0 : Mismatch Authentication type.

16、 Input packet specified type 0, we use type 1我們注意到我們并沒有配置密碼。也就是說在不配置密碼的情況下，仍需要雙方都啟用認(rèn)證才可以保持鄰居關(guān)系。為了使R1和R2的快速以太網(wǎng)口恢復(fù)鄰居關(guān)系，我們有兩種方法可以使用。第一種方法是在R1的快速以太網(wǎng)口關(guān)閉認(rèn)證，配置方法如下：R1(config)#int fa0/0R1(config-if)#ip ospf authentication nullR1(config-if)#*Aug 15 23:22:33.227: %OSPF-5-ADJCHG: Process 10, Nbr 2.2.2.2 on Fas

17、tEthernet0/0 from LOADING to FULL, Loading DoneR1#show ip ospf neiNeighbor ID Pri State Dead Time Address Interface2.2.2.2 1 FULL/DR 00:00:39 21.1.1.2 FastEthernet0/02.2.2.2 0 FULL/ - 00:00:30 10.1.1.2 Serial1/0鄰居關(guān)系已經(jīng)恢復(fù)。第二種是在R2上也開啟區(qū)域認(rèn)證，鄰居即可恢復(fù)。R2(config-router)#area 0 authenticationR2(config-router)#

18、*Aug 15 23:20:43.239: %OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on FastEthernet0/0 from LOADING to FULL, Loading Done鄰居關(guān)系也恢復(fù)了。  現(xiàn)在我們在R2上重啟OSPF進(jìn)程。R2#clear ip ospf pro Reset ALL OSPF processes? no: yR2#*Aug 15 23:28:01.275: %OSPF-5-ADJCHG: Process 10, Nbr 3.3.3.3 on OSPF_VL0 from FULL to DOWN, Neig

19、hbor Down: Interface down or detached*Aug 15 23:28:01.279: %OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on FastEthernet0/0 from FULL to DOWN, Neighbor Down: Interface down or detached*Aug 15 23:28:01.283: %OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on Serial1/0 from FULL to DOWN, Neighbor Down: Interface dow

20、n or detached*Aug 15 23:28:01.331: %OSPF-5-ADJCHG: Process 10, Nbr 3.3.3.3 on Serial1/1 from FULL to DOWN, Neighbor Down: Interface down or detachedR2# *Aug 15 23:28:03.247: %OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on FastEthernet0/0 from LOADING to FULL, Loading DoneR2#*Aug 15 23:28:05.911: %OSPF-5-

21、ADJCHG: Process 10, Nbr 1.1.1.1 on Serial1/0 from LOADING to FULL, Loading DoneR2#*Aug 15 23:28:10.423: %OSPF-5-ADJCHG: Process 10, Nbr 3.3.3.3 on Serial1/1 from LOADING to FULL, Loading DoneR2#等所有的鄰居關(guān)系起來后，我們到R1上看路由表，發(fā)現(xiàn)沒有R3的loopback端口。R1#sho ip rouCodes: C - connected, S - static, R - RIP, M - mobil

22、e, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate def

23、ault, U - per-user static route o - ODR, P - periodic downloaded static routeGateway of last resort is not set 1.0.0.0/24 is subnetted, 1 subnetsC 1.1.1.0 is directly connected, Loopback0 21.0.0.0/24 is subnetted, 1 subnetsC 21.1.1.0 is directly connected, FastEthernet0/0 10.0.0.0/24 is subnetted, 1

24、 subnetsC 10.1.1.0 is directly connected, Serial1/0 11.0.0.0/24 is subnetted, 1 subnetsO IA 11.1.1.0 110/65 via 21.1.1.2, 00:00:57, FastEthernet0/0因?yàn)镽3是通過虛鏈路連接到骨干區(qū)域的。我們看看R2和R3之間的虛鏈路是否正常：R2#sho ip ospf virtual-links Virtual Link OSPF_VL0 to router 3.3.3.3 is up Run as demand circuit DoNotAge LSA allo

25、wed. Transit area 1, via interface Serial1/1, Cost of using 64 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:06 Simple password authentication enabledR3#sho ip ospf virtual-links Virtual Link OSPF_VL0 to router

26、2.2.2.2 is up Run as demand circuit DoNotAge LSA allowed. Transit area 1, via interface Serial1/0, Cost of using 64 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5Hello due in 00:00:04因?yàn)関irtual-link屬于Area0，因此在R2配置完成Area0區(qū)域認(rèn)證后，R3也需要相

27、應(yīng)的配置。R3(config)#router ospf 10R3(config-router)#area 0 authentication R3(config-router)#*Aug 15 23:32:57.175: %OSPF-5-ADJCHG: Process 10, Nbr 2.2.2.2 on OSPF_VL0 from LOADING to FULL, Loading DoneR2#sho ip ospf virtual-links Virtual Link OSPF_VL0 to router 3.3.3.3 is up Run as demand circuit DoNotAg

28、e LSA allowed. Transit area 1, via interface Serial1/1, Cost of using 64 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:05 Adjacency State FULL (Hello suppressed) Index 3/4, retransmission queue length 0, number of retransmission 1 First 0x