BSCI实验之十三:配置点到点链路OSPF及认证

实验拓扑：

 

实验要求：分别在RA/RB/RC(即图中的R1/R2/R3)上启用OSPF，注意观察它们的网络类型以及邻居关系，并观察认证后的特点。

实验目的：熟练进行点到点OSPF的基本配置和认证调试。

实验仿真：DynamipsGUI

 

一、点到点链路OSPF的配置及调试

 

1、三个路由器的基本配置
-----------------------------------------
RA(config)#int l0
RA(config-if)#ip add 2.2.2.2 255.255.255.0
RA(config-if)#ip ospf network point-to-point      ----这里要配置网络类型
RA(config-if)#int s1/0
RA(config-if)#ip add 10.0.0.2 255.255.255.0
RA(config-if)#no shut
RA(config-if)#int s1/2
RA(config-if)#ip add 12.0.0.1 255.255.255.0
RA(config-if)#no shut
RA(config-if)#exit

RA(config)#router ospf 1                                       -----配置基本的OSPF
RA(config-router)#router-id 1.1.1.1                       -----指定路由器ID
RA(config-router)#network  1.1.1.0 0.0.0.255 area 0
RA(config-router)#net 10.0.0.0 0.0.0.255 area 0
RA(config-router)#net 12.0.0.0 0.0.0.255 area 0
RA(config-router)#end
-----------------------------------------------------
RB(config)#int l0
RB(config-if)#ip add 2.2.2.2 255.255.255.0
RB(config-if)#ip ospf network point-to-point
RB(config-if)#int s1/0
RB(config-if)#ip add 10.0.0.2 255.255.255.0
RB(config-if)#no shut
RB(config-if)#int s1/1
RB(config-if)#ip add 11.0.0.1 255.255.255.0
RB(config-if)#no shut
RB(config-if)#exit

RB(config)#router ospf 2
RB(config-router)#router-id 2.2.2.2
RB(config-router)#net 2.2.2.0 0.0.0.255 area 0
RB(config-router)#net 10.0.0.0 0.0.0.255 area 0
RB(config-router)#net 11.0.0.0 0.0.0.255 area 0
RB(config-router)#end
---------------------------------------------------
RC(config)#int l0
RC(config-if)#ip add 3.3.3.3 255.255.255.0
RC(config-if)#ip ospf network point-to-point
RC(config-if)#int s1/2
RC(config-if)#ip add 12.0.0.2 255.255.255.0
RC(config-if)#no shut
RC(config-if)#int s1/1
RC(config-if)#ip add 11.0.0.2 255.255.255.0
RC(config-if)#no shut
RC(config-if)#exit

RC(config)#router ospf 3
RC(config-router)#router-id 3.3.3.3
RC(config-router)#net 3.3.3.0 0.0.0.255 area 0
RC(config-router)#net 11.0.0.0 0.0.0.255 area 0
RC(config-router)#net 12.0.0.0 0.0.0.255 area 0
RC(config-router)#end

 

注意：在DynamipsGUI中进行配置时可不配时钟，但在实际的配置过程中，对DCE接口必须配置时钟。
-----------------------------------------------------
2、基本调试

RA#sh ip route ospf                  ------查看通过OSPF学习到的路由
     2.0.0.0/24 is subnetted, 1 subnets
O       2.2.2.0 [110/65] via 10.0.0.2, 00:00:14, Serial1/0
     3.0.0.0/24 is subnetted, 1 subnets
O       3.3.3.0 [110/65] via 12.0.0.2, 00:00:14, Serial1/2
     11.0.0.0/24 is subnetted, 1 subnets
O       11.0.0.0 [110/128] via 12.0.0.2, 00:00:14, Serial1/2
                 [110/128] via 10.0.0.2, 00:00:14, Serial1/0

 

RA#sh ip protocols                 -----查看路由
Routing Protocol is "ospf 1"        ------启用了OSPF，进程号为1
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Router ID 1.1.1.1                       ------路由器ID
  Number of areas in this router is 1. 1 normal 0 stub 0 nssa
  Maximum path: 4
  Routing for Networks:              -----路由的网络
    1.1.1.0 0.0.0.255 area 0
    10.0.0.0 0.0.0.255 area 0
    12.0.0.0 0.0.0.255 area 0
 Reference bandwidth unit is 100 mbps     ----路由花费参考带宽为100M
  Routing Information Sources:                   ----邻居路由器
    Gateway         Distance      Last Update
    3.3.3.3              110      00:01:14
    2.2.2.2              110      00:01:14
  Distance: (default is 110)

 

RA#sh ip ospf interface s1/2          -----查看接口
Serial1/2 is up, line protocol is up
  Internet Address 12.0.0.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type POINT_TO_POINT, Cost: 64
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5   ----hello/dead时间间隔
    …………

  Suppress hello for 0 neighbor(s)

RA#sh ip ospf nei            -----查看邻居

Neighbor ID     Pri   State           Dead Time   Address         Interface
3.3.3.3           0   FULL/  -        00:00:37    12.0.0.2        Serial1/2
2.2.2.2           0   FULL/  -        00:00:39    10.0.0.2        Serial1/0

从以上可见，在点对点环境下，没有DR/BDR选举，邻居关系自动建立。

 

RA#sh ip ospf database       -----查看LSDB，三张表的LSDB是一样的

            OSPF Router with ID (1.1.1.1) (Process ID 1)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
1.1.1.1         1.1.1.1         325         0x80000005 0x00E5BD 5
2.2.2.2         2.2.2.2         223         0x80000006 0x002F6D 5
3.3.3.3         3.3.3.3         202         0x80000005 0x00C1CF 5
===========================================================================================
二、OSPF认证配置

 

OSPF认证有基于区域和基于链路的认证，现分别介绍如下：

 

（一）基于区域的认证

 

1、明文认证：各个路由器的基本配置

-------------------------------------

RA(config)#router ospf 1
RA(config-router)#area 0 auth     -----启用基于区域的明文验证
RA(config-router)#int s1/0
RA(config-if)#ip ospf authentication-key 123    ----设置验证密钥
RA(config-if)#int s1/2
RA(config-if)#ip ospf authentication-key 123

RA(config-if)#end

-------------------------------------------

RB(config-router)#area 0 auth
RB(config-router)#int s1/0
RB(config-if)#ip ospf authentication-key 123
RB(config-if)#int s1/1
RB(config-if)#ip ospf authentication-key 123
------------------------------------------------------------------

RC(config)#router ospf 3
RC(config-router)#area 0 auth
RC(config-router)#int s1/1
RC(config-if)#ip ospf authentication-key 123
RC(config-if)#int s1/2
RC(config-if)#ip ospf authentication-key 1
--------------------------------------------------

2、明文认证：调试

RA#sh ip route ospf         ----查看通过OSPF学习到的路由
     2.0.0.0/24 is subnetted, 1 subnets
O       2.2.2.0 [110/65] via 10.0.0.2, 00:02:39, Serial1/0
     3.0.0.0/24 is subnetted, 1 subnets
O       3.3.3.0 [110/129] via 10.0.0.2, 00:02:39, Serial1/0
     11.0.0.0/24 is subnetted, 1 subnets
O       11.0.0.0 [110/128] via 10.0.0.2, 00:02:39, Serial1/0

RA#sh ip ospf              ----查看路由信息
  Routing Process "ospf 1" with ID 1.1.1.1
 Start time: 00:16:37.616, Time elapsed: 00:53:20.840
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 ……

 Cisco NSF helper support enabled
    Area BACKBONE(0)              ----区域0的信息
        Number of interfaces in this area is 3
        Area has simple password authentication      ------明文认证信息
        ……

        Flood list length 0
===================================================
3、MD5认证：各路由器基本配置

 

删除明文认证后重新配置如下：

RA(config)#router ospf 1
RA(config-router)#area 0 auth message-digest           -----区域0启用MD5验证
RA(config-router)#int s1/0
RA(config-if)#ip ospf message-digest-key 1 md5 123     -----设置认证KEY ID和密钥
RA(config-if)#int s1/2
RA(config-if)#ip ospf message-digest-key 1 md5 123
----------------------------------------------------------------------
RB(config)#router ospf 2
RB(config-router)#area 0 auth message-digest
RB(config-router)#int s1/0
RB(config-if)#ip ospf message-digest-key 1 md5 123
RB(config-if)#int s1/1
RB(config-if)#ip ospf message-digest-key 1 md5 123
-----------------------------------------------------------

RC(config)#router ospf 3
RC(config-router)#area 0 auth message-digest
RC(config-router)#int s1/1
RC(config-if)#ip ospf message-digest-key 1 md5 123
RC(config-if)#int s
*Apr 23 09:19:29.707: %OSPF-5-ADJCHG: Process 3, Nbr 2.2.2.2 on
OADING to FULL, Loading Done1/2
RC(config-if)#ip ospf message-digest-key 1 md5 123
-------------------------------------

4、MD5认证：调试

RA#sh ip route ospf
     2.0.0.0/24 is subnetted, 1 subnets
O       2.2.2.0 [110/65] via 10.0.0.2, 00:00:35, Serial1/0
     3.0.0.0/24 is subnetted, 1 subnets
O       3.3.3.0 [110/65] via 12.0.0.2, 00:00:35, Serial1/2
     11.0.0.0/24 is subnetted, 1 subnets
O       11.0.0.0 [110/128] via 12.0.0.2, 00:00:35, Serial1/2
                 [110/128] via 10.0.0.2, 00:00:35, Serial1/0

RA#sh ip ospf nei

Neighbor ID     Pri   State           Dead Time   Address         Interface
3.3.3.3           0   FULL/  -        00:00:37    12.0.0.2        Serial1/2
2.2.2.2           0   FULL/  -        00:00:37    10.0.0.2        Serial1/0

 

RA#sh ip ospf
  Routing Process "ospf 1" with ID 1.1.1.1
 Start time: 00:16:37.616, Time elapsed: 01:00:13.356
 ……

  Cisco NSF helper support enabled
    Area BACKBONE(0)                                   -----区域0信息
        Number of interfaces in this area is 3
        Area has message digest authentication             ----MD5认证
       ……

        Flood list length 0

 

RA#sh ip ospf int s1/2                   -----查看接口信息
Serial1/2 is up, line protocol is up
  Internet Address 12.0.0.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type POINT_TO_POINT, Cost: 64
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    ……

  Suppress hello for 0 neighbor(s)
  Message digest authentication enabled                   ----MD5认证信息
    Youngest key id is 1

-----------------------------------------------------------------------------

（一）基于链路的认证

 

 

基于链路的认证也分为明文和MD5验证。其配置过程同基于区域的配置过程基本相同，但需要在各个路由器配置中去掉启用区域认证这一句（以RA为例）：

RA(config)#router ospf 1
RA(config-router)#no area 0 auth message-digest           -----去掉区域0启用MD5验证

调试方法也参考基于区域的认证。

====================================================

 

实验总结：在点到点链路上配置OSPF，邻居关系自动创建，没有DR/BDP选举。OSPF的验证分为基于区域和基于链路的认证两种，其中基于链路的认证优于基于区域的认证。