华为 “OSPF” 认证配置

OSPF支持报文验证功能，只有通过验证的报文才能接收，否则将不能正常建立邻居关系。OSPF协议支持两种认证方式：区域认证和链路认证。使用区域认证时，一个区域中所有的路由器在该区域下的认证模式和口令必须一致；OSPF链路认证相比于区域认证更加灵活，可专门针对某个邻居设置独立的认证模式和密码。如果同时配置了接口认证和区域认证时，优先使用接口认证建立OSPF邻居。
每种认证方式又分为简单验证模式，MD5验证模式和Key chain验证模式。简单验证模式在数据传递过程中，认证密钥和密钥ID都是明文传输，容易被截获；MD5验证下的密钥是经过MD5加密传输，相比简单模式更为安全；Key chain 验证模式可以同时配置多个密钥，不同密钥单独设置生效周期等。

R3,R5,R6属于公司总部骨干路由器，R2为ABR。公司分部路由器R1和R4都属于区域1，R1作为市场部网关，R4作为财务部网关。网络管理员在区域0和区域1上部署OSPF区域认证。其中区域0开启密文认证，区域1开启明文认证。进一步提高OSPF网络安全性，R2，R4上单独设置密钥，配置OSPF链路认证。

[Huawei]sys R1
[R1]int loopback 0
[R1-LoopBack0]ip add 1.1.1.1 32 //配置设备环回口，接口IP。 其它设备接口配置不赘述
[R1-LoopBack0]int g 0/0/0
[R1-GigabitEthernet0/0/0]ip add 10.0.12.1 24

各台路由器上进行OSPF多区域配置
ospf 1 //R1
area 0.0.0.1
network 1.1.1.1 0.0.0.0
network 10.0.12.0 0.0.0.255

ospf 1 //R2
area 0.0.0.0
network 2.2.2.2 0.0.0.0
network 10.0.23.0 0.0.0.255
area 0.0.0.1
network 10.0.12.0 0.0.0.255
network 10.0.24.0 0.0.0.255

ospf 1 //R3
area 0.0.0.0
network 3.3.3.3 0.0.0.0
network 10.0.23.0 0.0.0.255
network 10.0.35.0 0.0.0.255
network 10.0.36.0 0.0.0.255

ospf 1 //R4
area 0.0.0.1
network 4.4.4.4 0.0.0.0
network 10.0.24.0 0.0.0.255

ospf 1 //R5
area 0.0.0.0
network 5.5.5.5 0.0.0.0
network 10.0.35.0 0.0.0.255

ospf 1 //R6
area 0.0.0.0
network 6.6.6.6 0.0.0.0
network 10.0.36.0 0.0.0.255

测试各接口环回口连通性
[R6]ping 1.1.1.1
PING 1.1.1.1: 56 data bytes, press CTRL_C to break
Reply from 1.1.1.1: bytes=56 Sequence=1 ttl=253 time=80 ms
Reply from 1.1.1.1: bytes=56 Sequence=2 ttl=253 time=40 ms
Reply from 1.1.1.1: bytes=56 Sequence=3 ttl=253 time=50 ms
Reply from 1.1.1.1: bytes=56 Sequence=4 ttl=253 time=30 ms

— 1.1.1.1 ping statistics —
4 packet(s) transmitted
4 packet(s) received
0.00% packet loss
round-trip min/avg/max = 30/50/80 ms

[R6]ping 2.2.2.2
PING 2.2.2.2: 56 data bytes, press CTRL_C to break
Reply from 2.2.2.2: bytes=56 Sequence=1 ttl=254 time=30 ms
Reply from 2.2.2.2: bytes=56 Sequence=2 ttl=254 time=30 ms
Reply from 2.2.2.2: bytes=56 Sequence=3 ttl=254 time=30 ms
Reply from 2.2.2.2: bytes=56 Sequence=4 ttl=254 time=40 ms
Reply from 2.2.2.2: bytes=56 Sequence=5 ttl=254 time=20 ms

— 2.2.2.2 ping statistics —
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 20/30/40 ms

[R6]ping 3.3.3.3
PING 3.3.3.3: 56 data bytes, press CTRL_C to break
Reply from 3.3.3.3: bytes=56 Sequence=1 ttl=255 time=30 ms
Reply from 3.3.3.3: bytes=56 Sequence=2 ttl=255 time=20 ms
Reply from 3.3.3.3: bytes=56 Sequence=3 ttl=255 time=20 ms
Reply from 3.3.3.3: bytes=56 Sequence=4 ttl=255 time=20 ms
Reply from 3.3.3.3: bytes=56 Sequence=5 ttl=255 time=20 ms

— 3.3.3.3 ping statistics —
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 20/22/30 ms

[R6]ping 4.4.4.4
PING 4.4.4.4: 56 data bytes, press CTRL_C to break
Reply from 4.4.4.4: bytes=56 Sequence=1 ttl=253 time=30 ms
Reply from 4.4.4.4: bytes=56 Sequence=2 ttl=253 time=40 ms
Reply from 4.4.4.4: bytes=56 Sequence=3 ttl=253 time=30 ms
Reply from 4.4.4.4: bytes=56 Sequence=4 ttl=253 time=40 ms

— 4.4.4.4 ping statistics —
4 packet(s) transmitted
4 packet(s) received
0.00% packet loss
round-trip min/avg/max = 30/35/40 ms

[R6]ping 5.5.5.5
PING 5.5.5.5: 56 data bytes, press CTRL_C to break
Reply from 5.5.5.5: bytes=56 Sequence=1 ttl=254 time=50 ms
Reply from 5.5.5.5: bytes=56 Sequence=2 ttl=254 time=40 ms
Reply from 5.5.5.5: bytes=56 Sequence=3 ttl=254 time=30 ms
Reply from 5.5.5.5: bytes=56 Sequence=4 ttl=254 time=30 ms
Reply from 5.5.5.5: bytes=56 Sequence=5 ttl=254 time=30 ms

— 5.5.5.5 ping statistics —
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 30/36/50 ms

//配置分部区域OSPF区域明文认证。视图下使用authentication-mode指定该区域使用认证模式为simple,即简单验证模式，配置口令为huawei1,并配置plain参数。配置plain参数后，可以使得在查看配置文件时，口令均以明文方式显示。
[R1]ospf 1
[R1-ospf-1]area 1
[R1-ospf-1-area-0.0.0.1]authentication-mode
[R1-ospf-1-area-0.0.0.1]authentication-mode simple plain huawei1
[R1-ospf-1-area-0.0.0.1]dis this
[V200R003C00]

area 0.0.0.1
authentication-mode simple plain huawei1 //明文方式显示口令
network 1.1.1.1 0.0.0.0
network 10.0.12.0 0.0.0.255

[R1]ospf 1
[R1-ospf-1]area 1
[R1-ospf-1-area-0.0.0.1]authentication-mode simple huawei1
[R1-ospf-1-area-0.0.0.1]dis this
[V200R003C00]

area 0.0.0.1
authentication-mode simple cipher % % /F~SKKaTeX parse error: Expected 'EOF', got '#' at position 1: #̲~h":@!s<^Dpw1)8…%$ //口令密文形式显示
network 1.1.1.1 0.0.0.0
network 10.0.12.0 0.0.0.255

//R1与R2邻居关系中断了，目前仅在R1上配置了认证，导致R1与R2间的OSPF认证不匹配
[R1]dis ospf peer brief
OSPF Process 1 with Router ID 1.1.1.1
Peer Statistic Information

Area Id Interface Neighbor id State

[R2]ospf 1
[R2-ospf-1]area 1
[R2-ospf-1-area-0.0.0.1]authentication-mode simple huawei1 //R2上配置验证模式与R1一致

//R1与R2邻居关系恢复正常
[R1]dis ospf peer brief

OSPF Process 1 with Router ID 1.1.1.1
Peer Statistic Information

Area Id Interface Neighbor id State
0.0.0.1 GigabitEthernet0/0/0 2.2.2.2 Full

//R4上做相同配置
[R4]ospf 1
[R4-ospf-1]area 1
[R4-ospf-1-area-0.0.0.1]authentication-mode simple huawei

//R2上查看OSPF邻居关系
[R2]dis ospf peer brief

OSPF Process 1 with Router ID 2.2.2.2
Peer Statistic Information

Area Id Interface Neighbor id State
0.0.0.0 GigabitEthernet0/0/2 3.3.3.3 Full
0.0.0.1 GigabitEthernet0/0/0 1.1.1.1 Full
0.0.0.1 GigabitEthernet0/0/1 4.4.4.4 Full //与区域1中的邻居关系建立正常

//配置总部OSPF Area 0 区域密文认证，使用验证模式为MD5，验证标识符为1，口令为huawei3
[R2]ospf 1
[R2-ospf-1]area 0
[R2-ospf-1-area-0.0.0.0]authentication-mode md5 1 huawei3

[R3]ospf 1
[R3-ospf-1]area 0
[R3-ospf-1-area-0.0.0.0]authentication-mode md5 1 huawei3

[R5]ospf 1
[R5-ospf-1]area 0
[R5-ospf-1-area-0.0.0.0]authentication-mode md5 1 huawei3

[R6]ospf 1
[R6-ospf-1]area 0
[R6-ospf-1-area-0.0.0.0]authentication-mode md5 1 huawei3

//查看R3 OSPF 邻居状态
[R3]dis ospf peer brief

OSPF Process 1 with Router ID 10.0.35.3
Peer Statistic Information

Area Id Interface Neighbor id State
0.0.0.0 GigabitEthernet0/0/0 10.0.35.5 Full
0.0.0.0 GigabitEthernet0/0/1 10.0.36.6 Full
0.0.0.0 GigabitEthernet0/0/2 10.0.12.2 Full

//配置OSPF链路认证，使用了OSPF的区域认证方式配置了OSPF认证，使用链路认证方式配置可以达到同样的效果。如果采用链路认证的方式，就需要在同一OSPF的链路接口下都配置链路认证的命令（验证模式和口令参数），而采用区域认证的方式，在同一区域中，仅需在OSPF进程下的相应区域视图下配置一条命令来设置验证模式和口令即可，所以在同一区域中如果有多台OSPF设备需要配置认证，建议选用区域认证的方式配置。

//区域1中配置了简单模式的区域认证，为了提高R2与R4之间OSPF网络安全性，网络管理员在两台设备之间部署MD5验证模式和OSPF链路认证。

[R2]int g 0/0/1
[R2-GigabitEthernet0/0/1]ospf authentication-mode md5 1 huawei5 //配置链路认证，MD5验证模式，标识符1，口令huawei5
[R2-GigabitEthernet0/0/1]dis ospf peer brief

OSPF Process 1 with Router ID 10.0.12.2
Peer Statistic Information

Area Id Interface Neighbor id State //可以看到R2与R4的邻居关系已经消失
0.0.0.0 GigabitEthernet0/0/2 10.0.35.3 Full
0.0.0.1 GigabitEthernet0/0/0 10.0.12.1 Full

//同时配置接口认证和区域认证，会优先使用接口验证建立OSPF邻居。即需要在R4上也配置链路认证（验证模式，标识符，口令保持一致）

[R4]int g 0/0/0
[R4-GigabitEthernet0/0/0]ospf authentication-mode md5 1 huawei5

[R2]dis ospf peer brief
OSPF Process 1 with Router ID 10.0.12.2
Peer Statistic Information

Area Id Interface Neighbor id State
0.0.0.0 GigabitEthernet0/0/2 10.0.35.3 Full //可以看到邻居关系恢复正常
0.0.0.1 GigabitEthernet0/0/0 10.0.12.1 Full
0.0.0.1 GigabitEthernet0/0/1 10.0.24.4 Full