自拍偷在线精品自拍偷,亚洲欧美中文日韩v在线观看不卡

驗證OSPF鄰居認(rèn)證的過程

作者：佚名
企業(yè)動態(tài)
鄰居認(rèn)證使得路由器確認(rèn)每次所收到的路由更新的源。如果關(guān)鍵字不匹配，就會拒絕路由更新。

鄰居認(rèn)證使得路由器確認(rèn)每次所收到的路由更新的源。如果關(guān)鍵字不匹配，就會拒絕路由更新。

Cisco使用兩種類型的鄰居認(rèn)證：純文本和MD5。

純文本認(rèn)證發(fā)一個關(guān)鍵字，這個關(guān)鍵字是明文傳輸，可被非法用戶所竊取，所以不推薦使用。

MD5認(rèn)證 發(fā)一個報文摘要，而不是關(guān)鍵字。MD5被用來生成一個關(guān)鍵字的散列。這個散列是被發(fā)送的對象。MD5方式不易被非法用戶所竊取。

這個案例中，我們在R1與R2之間使用明文認(rèn)證，在R2與R3之間使用MD5認(rèn)證。

// R1 //

int e0/0
ip ad 192.1.1.1 255.255.255.0
ip ospf authentication-key cisco//明文認(rèn)證，關(guān)鍵字為cisco
router os 1
network 192.1.1.1 0.0.0.0 area 0
area 0 authentication

// R2 // 
int e0/0
ip ad 192.1.1.2 255.255.255.0
ip ospf authentication-key cisco//明文認(rèn)證，關(guān)鍵字為cisco

int e1/0
ip ad 193.1.1.2 255.255.255.0
ip ospf message-digest-key 1 md5 cracker

router os 1
network 192.1.1.2 0.0.0.0 area 0
network 193.1.1.2 0.0.0.0 area 1
area 0 authentication
area 1 authentication message-digest


// R3 // 
int e1/0
ip ad 193.1.1.3 255.255.255.0
ip ospf message-digest-key 1 md5 cracker

router os 1
network 193.1.1.3 0.0.0.0 a 1
area 1 authentication message-digest


驗證過程： 
r1#sh ip os int e0/0
Ethernet0/0 is up, line protocol is up
Internet Address 192.1.1.1/24, Area 0
Process ID 1, Router ID 192.1.1.1, Network Type BROADCAST, Cost: 10
Transmit Delay is 1 sec, State BDR, Priority 1
Designated Router (ID) 193.1.1.2, Interface address 192.1.1.2
Backup Designated router (ID) 192.1.1.1, Interface address 192.1.1.1
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Hello due in 00:00:06
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 1, maximum is 1
Last flood scan time is 0 msec, maximum is 0 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 193.1.1.2(Designated Router)
Suppress hello for 0 neighbor(s)
Simple password authentication enabled

r2#sh ip os int e0/0
Ethernet0/0 is up, line protocol is up
Internet Address 192.1.1.2/24, Area 0
Process ID 1, Router ID 193.1.1.2, Network Type BROADCAST, Cost: 10
Transmit Delay is 1 sec, State DR, Priority 1
Designated Router (ID) 193.1.1.2, Interface address 192.1.1.2
Backup Designated router (ID) 192.1.1.1, Interface address 192.1.1.1
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Hello due in 00:00:04
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 1, maximum is 2
Last flood scan time is 0 msec, maximum is 0 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 192.1.1.1(Backup Designated Router)
Suppress hello for 0 neighbor(s)
Simple password authentication enabled

r2#sh ip os int e1/0
Ethernet1/0 is up, line protocol is up
Internet Address 193.1.1.2/24, Area 1
Process ID 1, Router ID 193.1.1.2, Network Type BROADCAST, Cost: 10
Transmit Delay is 1 sec, State DR, Priority 1
Designated Router (ID) 193.1.1.2, Interface address 193.1.1.2
Backup Designated router (ID) 193.1.1.3, Interface address 193.1.1.3
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Hello due in 00:00:03
Index 1/2, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 2, maximum is 2
Last flood scan time is 0 msec, maximum is 0 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 193.1.1.3(Backup Designated Router)
Suppress hello for 0 neighbor(s)
Message digest authentication enabled
Youngest key id is 1

r3#sh ip os int e1/0
Ethernet1/0 is up, line protocol is up
Internet Address 193.1.1.3/24, Area 1
Process ID 1, Router ID 193.1.1.3, Network Type BROADCAST, Cost: 10
Transmit Delay is 1 sec, State BDR, Priority 1
Designated Router (ID) 193.1.1.2, Interface address 193.1.1.2
Backup Designated router (ID) 193.1.1.3, Interface address 193.1.1.3
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Hello due in 00:00:04
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 1, maximum is 2
Last flood scan time is 0 msec, maximum is 0 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 193.1.1.2(Designated Router)
Suppress hello for 0 neighbor(s)
Message digest authentication enabled
Youngest key id is 1


為了更進(jìn)一步理解認(rèn)證過程，我們可以打開DEBUG，并將R3的MD5認(rèn)證key改為5：
// R3 // 
debug ip ospf adj
int e1/0
ip ospf message-digest-key 5 md5 cracker

r3#
01:16:03: OSPF: Rcv pkt from 193.1.1.2, Ethernet1/0 : Mismatch Authentication Key - No message digest key 1 on interface
01:16:09: OSPF: Send with youngest Key 5


r3#show ip ospf neighbor//觀察結(jié)果無法發(fā)現(xiàn)鄰居。

//認(rèn)證未通過，無法與R2建立起鄰居關(guān)系。

當(dāng)我們把MD5認(rèn)證KEY改回1后，認(rèn)證通過。


第二步實驗，我們把關(guān)鍵字進(jìn)行修改：
// R3 //

debug ip ospf adj
int e1/0
ip ospf message-digest-key 1 md5 cuijian
01:21:33: OSPF: Rcv pkt from 193.1.1.2, Ethernet1/0 : Mismatch Authentication Key - Message Digest Key 1
01:21:40: OSPF: Send with youngest Key 1

我們要在實際工作中學(xué)會使用debug這個思科排錯的利器。

【編輯推薦】

  1. 基于OSPF路由協(xié)議，組建全國互連項目
  2. 目前CCNA考試中switch與OSPF實驗題的解答方法
  3. 雙nat路由試驗，走ospf動態(tài)路由
責(zé)任編輯：夏雨 來源： 56CTO
OSPF鄰居認(rèn)證路由器
相關(guān)推薦

2020-07-03 09:16:13

OSPF鄰居子網(wǎng)掩碼

2013-11-01 10:51:10

OSPF鄰居鄰接

2011-03-30 16:27:07

POS接口OSPF

2011-04-11 16:29:31

OSPF

2009-09-07 09:28:00

思科認(rèn)證CCSPCCSP認(rèn)證過程

2010-06-10 16:01:22

OSPF路由協(xié)議

2011-04-08 17:42:13

OSPFOSPF鄰居

2011-05-17 13:25:53

IBGPOSPF路由表

2011-04-11 16:20:06

OSPF

2013-07-01 11:27:11

2011-04-01 09:40:28

OSPF路由器

2025-04-11 10:18:58

2011-08-18 09:46:40

活動目錄驗證原理

2009-08-18 13:49:03

思科認(rèn)證CCNA報考

2019-11-24 19:20:57

OSPF鄰居路由器

2009-01-11 09:29:00

網(wǎng)絡(luò)鄰居故障

2013-06-06 13:42:48

OSPF入門配置

2010-04-20 10:00:29

2009-01-11 09:30:00

局域網(wǎng)網(wǎng)上鄰居

2013-10-18 09:30:04

OSPF協(xié)議OSPF
點贊
收藏

51CTO技術(shù)棧公眾號