OSPF实验5：OSPF认证完整总结
实验等级：Expert
实验拓扑：
实验说明：
OSPF的认证有2种类型（确切说是3种），其中type0表示无认证，type1表示明文认证，type2表示MD5认证。明文认证发送密码进行认证，而MD5认证发送的是报文摘要。有关MD5的详细信息，可以参阅RFC1321. OSPF的认证可以在链路上进行，也可以在整个区域内进行认证。另外虚链路同样也可以进行认证。
实验基本配置：
R1: interface Loopback0 ip address 1.1.1.1 255.255.255.0 ! interface FastEthernet0/0 ip address 21.1.1.1 255.255.255.0 duplex half ! router ospf 10 router-id 1.1.1.1 log-adjacency-changes network 10.1.1.0 0.0.0.255 area 0 network 21.1.1.0 0.0.0.255 area 0
R2： interface Loopback0 ip address 2.2.2.2 255.255.255.0 ! interface FastEthernet0/0 ip address 21.1.1.2 255.255.255.0 duplex half ! interface Serial1/0 ip address 10.1.1.2 255.255.255.0 serial restart-delay 0 ! interface Serial1/1 ip address 11.1.1.1 255.255.255.0 serial restart-delay 0 ! router ospf 10 router-id 2.2.2.2 log-adjacency-changes area 1 virtual-link 3.3.3.3 network 10.1.1.0 0.0.0.255 area 0 network 11.1.1.0 0.0.0.255 area 1 network 21.1.1.0 0.0.0.255 area 0
R3： interface Loopback0 ip address 3.3.3.3 255.255.255.0 ! interface Serial1/0 ip address 11.1.1.2 255.255.255.0 serial restart-delay 0 ! router ospf 10 router-id 3.3.3.3 log-adjacency-changes area 1 virtual-link 2.2.2.2 network 3.3.3.0 0.0.0.255 area 2 network 11.1.1.0 0.0.0.255 area 1
认证配置： 1. 在R1和R2的串行链路上进行OSPF明文认证： 首先先在R1上做如下配置，看在R1配置完认证，R2还没有配置认证的时候的情况： R1(config)#int s1/0 R1(config-if)#ip ospf authentication（启用认证） R1(config-if)#ip ospf authentication-key cisco（配置密码）
通过debug工具我们可以看到如下信息： *Aug 15 22:51:54.275: OSPF: Rcv pkt from 10.1.1.2, Serial1/0 : Mismatch Authentication type. Input packet specified type 0, we use type 1 这里的type0是指对方没有启用认证，type1是明文认证。
在R2上配置认证，使得邻居关系恢复。 R2(config)#int s1/0 R2(config-if)#ip ospf authentication R2(config-if)#ip ospf authentication-key cisco *Aug 15 22:54:55.815: %OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on Serial1/0 from LOADING to FULL, Loading Done
2.在R2和R3的串行链路上进行MD5认证的： R2(config)#int s1/1 R2(config-if)#ip ospf authentication message-digest（定义认证类型为MD5） R2(config-if)#ip ospf message-digest-key 1 md5 cisco（定义key和密码） R3(config)#int s1/0 R3(config-if)#ip ospf authentication message-digest R3(config-if)#ip ospf message-digest-key 1 md5 cisco R3(config-if)# *Aug 15 22:59:44.175: %OSPF-5-ADJCHG: Process 10, Nbr 2.2.2.2 on Serial1/0 from LOADING to FULL, Loading Done
R3#show ip ospf int s1/0 Serial1/0 is up, line protocol is up Internet Address 11.1.1.2/24, Area 1 Process ID 10, Router ID 3.3.3.3, Network Type POINT_TO_POINT, Cost: 64 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:05 Index 1/1, flood queue length 1 Next 0x648352C8(13)/0x0(0) Last flood scan length is 1, maximum is 2 Last flood scan time is 0 msec, maximum is 0 msec Flood pacing timer due in 0 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 2.2.2.2 Suppress hello for 0 neighbor(s) Message digest authentication enabled Youngest key id is 1
3.修改R2和R3上串行链路的MD5认证的密码： 在R2原有的配置上加上下面这条命令： R2(config-if)#ip ospf message-digest-key 2 md5 gairuhe R2#sho ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface 3.3.3.3 0 FULL/ - - 11.1.1.2 OSPF_VL0 1.1.1.1 1 FULL/BDR 00:00:34 21.1.1.1 FastEthernet0/0 1.1.1.1 0 FULL/ - 00:00:37 10.1.1.1 Serial1/0 3.3.3.3 0 FULL/ - 00:00:31 11.1.1.2 Serial1/1 我们发现邻居关系没有丢失。 R2#show ip ospf interface s1/1 Serial1/1 is up, line protocol is up Internet Address 11.1.1.1/24, Area 1 Process ID 10, Router ID 2.2.2.2, Network Type POINT_TO_POINT, Cost: 64 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:01 Index 1/3, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 1, maximum is 1 Last flood scan time is 4 msec, maximum is 4 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 3.3.3.3 Suppress hello for 0 neighbor(s) Message digest authentication enabled Youngest key id is 2 Rollover in progress, 1 neighbor(s) using the old key(s): key id 1 这里我们可以看到两个key都在使用。 所以要修改链路的MD5认证的密码时，可以先将新的密码配置到启用认证的路由器后在将原来的密码删除，这样的话可以保证在修改配置的时候邻居关系依然存在。
4.在Area0上进行区域认证 R1(config)#router ospf 10 R1(config-router)#area 0 authentication R1(config-router)# *Aug 15 23:09:32.619: %OSPF-5-ADJCHG: Process 10, Nbr 2.2.2.2 on FastEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired 发现快速以太网接口的邻居已经丢失。通过debug信息我们看到： R1# *Aug 15 23:10:32.619: OSPF: Rcv pkt from 21.1.1.2, FastEthernet0/0 : Mismatch Authentication type. Input packet specified type 0, we use type 1
我们注意到我们并没有配置密码。也就是说在不配置密码的情况下，仍需要双方都启用认证才可以保持邻居关系。
为了使R1和R2的快速以太网口恢复邻居关系，我们有两种方法可以使用。
第一种方法是在R1的快速以太网口关闭认证，配置方法如下： R1(config)#int fa0/0 R1(config-if)#ip ospf authentication null R1(config-if)# *Aug 15 23:22:33.227: %OSPF-5-ADJCHG: Process 10, Nbr 2.2.2.2 on FastEthernet0/0 from LOADING to FULL, Loading Done R1#show ip ospf nei
Neighbor ID Pri State Dead Time Address Interface 2.2.2.2 1 FULL/DR 00:00:39 21.1.1.2 FastEthernet0/0 2.2.2.2 0 FULL/ - 00:00:30 10.1.1.2 Serial1/0
邻居关系已经恢复。
第二种是在R2上也开启区域认证，邻居即可恢复。 R2(config-router)#area 0 authentication R2(config-router)# *Aug 15 23:20:43.239: %OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on FastEthernet0/0 from LOADING to FULL, Loading Done 邻居关系也恢复了。 现在我们在R2上重启OSPF进程。 R2#clear ip ospf pro Reset ALL OSPF processes? [no]: y R2# *Aug 15 23:28:01.275: %OSPF-5-ADJCHG: Process 10, Nbr 3.3.3.3 on OSPF_VL0 from FULL to DOWN, Neighbor Down: Interface down or detached *Aug 15 23:28:01.279: %OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on FastEthernet0/0 from FULL to DOWN, Neighbor Down: Interface down or detached *Aug 15 23:28:01.283: %OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on Serial1/0 from FULL to DOWN, Neighbor Down: Interface down or detached *Aug 15 23:28:01.331: %OSPF-5-ADJCHG: Process 10, Nbr 3.3.3.3 on Serial1/1 from FULL to DOWN, Neighbor Down: Interface down or detached R2# *Aug 15 23:28:03.247: %OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on FastEthernet0/0 from LOADING to FULL, Loading Done R2# *Aug 15 23:28:05.911: %OSPF-5-ADJCHG: Process 10, Nbr 1.1.1.1 on Serial1/0 from LOADING to FULL, Loading Done R2# *Aug 15 23:28:10.423: %OSPF-5-ADJCHG: Process 10, Nbr 3.3.3.3 on Serial1/1 from LOADING to FULL, Loading Done R2#
等所有的邻居关系起来后，我们到R1上看路由表，发现没有R3的loopback端口。
R1#sho ip rou Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
1.0.0.0/24 is subnetted, 1 subnets C 1.1.1.0 is directly connected, Loopback0 21.0.0.0/24 is subnetted, 1 subnets C 21.1.1.0 is directly connected, FastEthernet0/0 10.0.0.0/24 is subnetted, 1 subnets C 10.1.1.0 is directly connected, Serial1/0 11.0.0.0/24 is subnetted, 1 subnets O IA 11.1.1.0 [110/65] via 21.1.1.2, 00:00:57, FastEthernet0/0
因为R3是通过虚链路连接到骨干区域的。我们看看R2和R3之间的虚链路是否正常：
R2#sho ip ospf virtual-links Virtual Link OSPF_VL0 to router 3.3.3.3 is up Run as demand circuit DoNotAge LSA allowed. Transit area 1, via interface Serial1/1, Cost of using 64 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:06 Simple password authentication enabled
R3#sho ip ospf virtual-links Virtual Link OSPF_VL0 to router 2.2.2.2 is up Run as demand circuit DoNotAge LSA allowed. Transit area 1, via interface Serial1/0, Cost of using 64 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:04
因为virtual-link属于Area0，因此在R2配置完成Area0区域认证后，R3也需要相应的配置。 R3(config)#router ospf 10 R3(config-router)#area 0 authentication
R3(config-router)# *Aug 15 23:32:57.175: %OSPF-5-ADJCHG: Process 10, Nbr 2.2.2.2 on OSPF_VL0 from LOADING to FULL, Loading Done R2#sho ip ospf virtual-links Virtual Link OSPF_VL0 to router 3.3.3.3 is up Run as demand circuit DoNotAge LSA allowed. Transit area 1, via interface Serial1/1, Cost of using 64 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:05 Adjacency State FULL (Hello suppressed) Index 3/4, retransmission queue length 0, number of retransmission 1 First 0x0(0)/0x0(0) Next 0x0(0)/0x0(0) Last retransmission scan length is 1, maximum is 1 Last retransmission scan time is 0 msec, maximum is 0 msec Simple password authentication enabled
5.虚链路的认证配置
虚链路也可以单独配置认证，同样分为Null，明文认证，MD5认证。配置命令如下：
Null： R2(config-router)#area 1 virtual-link 3.3.3.3 authentication null R3(config-router)#area 1 virtual-link 2.2.2.2 authentication null
明文： R2(config-router)#area 1 virtual-link 3.3.3.3 authentication-key cisco R3(config-router)#area 1 virtual-link 2.2.2.2 authentication-key cisco
MD5： R2(config-router)#area 1 virtual-link 3.3.3.3 authentication message-digest R2(config-router)#area 1 virtual-link 3.3.3.3 message-digest-key 1 md5 cisco R3(config-router)#area 1 virtual-link 2.2.2.2 authentication message-digest R3(config-router)#area 1 virtual-link 2.2.2.2 message-digest-key 1 md5 cisco
另外在上个实验我们知道虚链路在建立起来后是DNA LSA（不老化LSA），所以如果没有重启OSPF进程的话，即使一端配置了认证，虚链路也是不会断开的。
本文出自 “盖如鹤的步徒” 博客，请务必保留此出处http://gairuhe.blog.51cto.com/77728/38485