实验目的：

比较RIP,EIGRP,OSPF的认证

实验拓扑：

实验步骤：

RIP的认证：

Step1:在全局模式,配置KEY-CHAIN:

key chain ccnp//定义钥匙链

key 1

key-string cisco //钥匙链上的钥匙，也即是密码。

step2:在接口中,调用key chain:

R1(config-if)#ip rip authentication key-chain CCNP //调用钥匙链

Step3:在接口中,选择认证类型:(明文/密文)

R1 (config-if)#ip rip authentication mode text (明文)(默认的,可以不打这条命令)

R1 (config-if)#ip rip authentication mode md5 (密文)

明文认证方式：

R1：配置

key chain ccie

key 1

key-string cisco

interface Serial1/1

ip address 192.168.12.1 255.255.255.0

ip rip authentication key-chain ccie

ip rip authentication mode text //系统默认

serial restart-delay 0

只配置一方时，会提示一下错误：

*Jun 4 10:16:39.031: RIP: ignored v2 packet from 192.168.12.2 (invalid authentication)

MD5认证方式：

R2：配置

key chain ccie

key 1

key-string cisco

interface Serial1/1

ip address 192.168.12.2 255.255.255.0

ip rip authentication key-chain ccie

ip rip authentication mode md5

serial restart-delay 0

R2#show ip route rip

1.0.0.0/32 is subnetted, 1 subnets

R 1.1.1.1 [120/1] via 192.168.12.1, 00:00:03, Serial1/0

不知道为什么在debug信息中看不出来认证信息。

R2#show ip protocols

Routing Protocol is "rip"

Sending updates every 30 seconds, next due in 8 seconds

Invalid after 180 seconds, hold down 180, flushed after 240

Outgoing update filter list for all interfaces is not set

Incoming update filter list for all interfaces is not set

Redistributing: rip

Default version control: send version 2, receive version 2

Interface Send Recv Triggered RIP Key-chain

Serial1/0 2 2 ccie

Loopback0 2 2

Loopback2 2 2

Automatic network summarization is not in effect

Maximum path: 4

Routing for Networks:

2.0.0.0

22.0.0.0

192.168.12.0

Routing Information Sources:

Gateway Distance Last Update

192.168.12.1 120 00:00:17

Distance: (default is 120)

EIGRP 的认证方式：（只支持MD5认证）

R1#show run int s1/1

Building configuration...

Current configuration : 168 bytes

!

interface Serial1/1

ip address 192.168.12.1 255.255.255.0

ip authentication mode eigrp 1 md5 //注意与RIP的命令不一样

ip authentication key-chain eigrp 1 ccie

serial restart-delay 0

end

debug ip eigrp notifications

R2(config-router)#

*Jun 4 10:29:43.347: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192.168.12.1 (Serial1/0) is up: new adjacency

R2(config-router)#

*Jun 4 10:31:07.435: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192.168.12.1 (Serial1/0) is down: Interface Goodbye received

R2(config-router)#

*Jun 4 10:31:11.991: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192.168.12.1 (Serial1/0) is up: new adjacency

R2(config-router)#

*Jun 4 10:31:33.775: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192.168.12.1 (Serial1/0) is down: Auth failure

R2配置完毕后，R1的调试信息：

R1#debug ip eigrp notifications

IP-EIGRP Event notification debugging is on

R1#

*Jun 4 10:36:43.663: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 192.168.12.2 (Serial1/1) is up: new adjacency

OSPF认证方式：

共有3中认证方式：

1.无认证（默认）

2.明文认证

3.MD5认证

R2:明文认证：

interface Serial1/0

ip address 192.168.12.2 255.255.255.0

ip ospf authentication-key ccie

serial restart-delay 0

router ospf 1

router-id 2.2.2.2

log-adjacency-changes

area 0 authentication

配置完后就会提示如下信息：

2#

*Jun 4 10:43:32.083: %SYS-5-CONFIG_I: Configured from console by console

R2#

*Jun 4 10:43:32.391: OSPF: Rcv pkt from 192.168.12.1, Serial1/0 : Mismatch Authentication type. Input packet specified type 0, we use type 1

R2#

*Jun 4 10:43:38.903: OSPF: Send hello to 224.0.0.5 area 0 on Serial1/0 from 192.168.12.2

R2#

*Jun 4 10:43:42.359: OSPF: Rcv pkt from 192.168.12.1, Serial1/0 : Mismatch Authentication type. Input packet specified type 0, we use type 1

密文认证：

只改了R2的配置

R2(config-if)#

*Jun 4 10:49:12.331: OSPF: Rcv pkt from 192.168.12.1, Serial1/0 : Mismatch Authentication type. Input packet specified type 1, we use type 2

router ospf 1

router-id 2.2.2.2

log-adjacency-changes

area 0 authentication message-digest

interface Serial1/0

ip address 192.168.12.2 255.255.255.0

ip ospf authentication message-digest

ip ospf message-digest-key 1 md5 cisco

serial restart-delay 0

本文转自 gehailong 51CTO博客，原文链接：http://blog.51cto.com/gehailong/297363，如需转载请自行联系原作者