Router Configuration<4>
配置OSPF被动接口
Target:
配置RIP被动接口用来过滤路由的条目，增强网络的安全性。
原理：
使用被动接口，禁止在连接服务器路由器的接口上发送OSPF更新和hello报文。
拓扑图：
Setp：
步骤1 在路由器上配置IP路由选择和IP地址。
RA#config t
RA(config)# interface FastEthernet 0/0
RA(config-if)#ip address 172.16.1.5 255.255.255.252
RA(config)#interface FastEthernet 0/1
RA(config-if)#ip address 172.16.1.1 255.255.255.252
RA(config)#interface Loopback 0
RA(config-if)#ip address 172.16.3.1 255.255.255.0
RB(config)#interface FastEthernet 0/1
RB(config-if)#ip address 172.16.1.2 255.255.255.252
RB(config)#interface Loopback 0
RB(config-if)#ip address 172.16.2.1 255.255.255.0
RC(config)#interface FastEthernet 0/0
RC(config-if)#ip address 172.16.4.1 255.255.255.0
RC(config)#interface FastEthernet 0/1
RC(config-if)#i p address 172.16.1.6 255.255.255.252
步骤2 配置OSPF。
RA(config)#router ospf 10
RC(config-router)#network 172.16.1.0 0.0.0.3 area 0
RC(config-router)#network 172.16.1.4 0.0.0.3 area 0
RC(config-router)#network 172.16.3.0 0.0.0.255 area 0
RB(config)#router ospf 10
RB(config-router)#network 172.16.1.0 0.0.0.3 area 0
RB(config-router)#network 172.16.2.0 0.0.0.255 area 0
RC(config)#router ospf 10
RC(config-router)#network 172.16.1.4 0.0.0.3 area 0
RC(config-router)#network 172.16.4.0 0.0.0.255 area 0
步骤3 配置被动接口。
RC(config-router)#passive-interface FastEthernet 0/0
步骤4 验证测试。
用debug ip ospf packet send来测试RIP更新。
下面显示的是完成“步骤2”时的测试，Ospf更新和hello报文会从Fa0/0接口上发送，这样对于安全和带宽都有影响。
RC#debug ip ospf packet send
Sep 7 01:56:21 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:56:26 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/0:172.16.4.1, length 44
Sep 7 01:56:31 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:56:37 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/0:172.16.4.1, length 44
Sep 7 01:56:40 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:56:47 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/0:172.16.4.1, length 44
Sep 7 01:56:51 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:56:56 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/0:172.16.4.1, length 44
Sep 7 01:57:01 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:57:07 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/0:172.16.4.1, length 44
Sep 7 01:57:10 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:57:17 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/0:172.16.4.1, length 44
Sep 7 01:57:21 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
下面显示的是完成“步骤3”时的测试，OSPF更新和hello只从Fa0/1接口上发送，不会从Fa0/0发送更新。
RC#debug ip ospf packet send
Sep 7 01:58:16 RC %7:SEND[LS-Upd]: 1 LSAs to destination 224.0.0.5
Sep 7 01:58:16 RC %7:SEND[LS-Upd]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 76
Sep 7 01:58:21 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:58:31 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:58:40 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:58:50 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:58:59 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6,
length 48
Sep 7 01:59:10 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:59:20 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:59:29 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:59:40 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:59:50 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 01:59:59 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 02:00:10 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
Sep 7 02:00:20 RC %7:SEND[Hello]: To 224.0.0.5 via FastEthernet 0/1:172.16.1.6, length 48
【参考配置】
RA#show running-config
Building configuration...
Current configuration : 699 bytes
!
version RGNOS 10.1.00(4), Release(18443)(Tue Jul 17 20:50:30 CST 2007 -ubu1server)
hostname RA
!
enable secret 5 $1$db44$8x67vy78Dz5pq1xD
!
interface FastEthernet 0/0
ip address 172.16.1.5 255.255.255.252
duplex auto
speed auto
!
interface FastEthernet 0/1
ip address 172.16.1.1 255.255.255.252
duplex auto
speed auto
!
interface Loopback 0
ip address 172.16.3.1 255.255.255.0
!
router ospf 10
network 172.16.1.0 0.0.0.3 area 0
network 172.16.1.4 0.0.0.3 area 0
network 172.16.3.0 0.0.0.255 area 0
!
line con 0
line aux 0
line vty 0 4
login
!
end!
RB#show running-config
Building configuration...
Current configuration : 634 bytes
!
version RGNOS 10.1.00(4), Release(18443)(Tue Jul 17 20:50:30 CST 2007 -ubu1server)
hostname RB
!
enable secret 5 $1$db44$8x67vy78Dz5pq1xD
!
interface FastEthernet 0/0
duplex auto
speed auto
shutdown
!
interface FastEthernet 0/1
ip address 172.16.1.2 255.255.255.252
duplex auto
speed auto
!
interface Loopback 0
ip address 172.16.2.1 255.255.255.0
!
router ospf 10
network 172.16.1.0 0.0.0.3 area 0
network 172.16.2.0 0.0.0.255 area 0
!
!
line con 0
line aux 0
line vty 0 4
login
!
end
RC#show running-config
Building configuration...
Current configuration : 660 bytes
!
version RGNOS 10.1.00(4), Release(18443)(Tue Jul 17 20:50:30 CST 2007 -ubu1server)
hostname RC
!
enable secret 5 $1$db44$8x67vy78Dz5pq1xD
!
interface FastEthernet 0/0
ip address 172.16.4.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet 0/1
ip address 172.16.1.6 255.255.255.252
duplex auto
speed auto
!
interface Loopback 0
!
router ospf 10
passive-interface FastEthernet 0/0
network 172.16.1.4 0.0.0.3 area 0
network 172.16.4.0 0.0.0.255 area 0
!
line con 0
line aux 0
line vty 0 4
login