OSPF分解试验部分-LAB2：OSPF认证
LAB2：OSPF认证
试验需求：
OSPF认证分为链路认证和区域认证，本试验带大家掌握这两种方法的认证配置。
1.链路明文认证
配置
R1
interface Ethernet0/0
ip ospf authentication 启用OSPF认证
ip ospf authentication-key cisco 认证密钥KEY是cisco
R2同上
2.链路密文认证
R1
interface Ethernet0/0
ip ospf authentication message-digest 启用基于MD5的认证
ip ospf message-digest-key 1 md5 cisco
R2同上
3.区域明文认证
R1
router ospf 1
router-id 1.1.1.1
area 0 authentication
network 123.1.1.1 0.0.0.0 area 0
interface Ethernet0/0
ip address 123.1.1.1 255.255.255.0
ip ospf authentication-key cisco
R2同上
4．区域密文认证
R1
router ospf 1
router-id 1.1.1.1
area 0 authentication message-digest
interface Ethernet0/0
ip address 123.1.1.1 255.255.255.0
ip ospf message-digest-key 1 md5 cisco
密文认证比明文认证的优点：
密文认证在割接的时候可以很方便的不断网的情况下，平滑的替换密钥
测试：
R1/R2使用密文认证，替换密钥为cisco123
R1#show ip os in e0/0
Ethernet0/0 is up, line protocol is up
Internet Address 123.1.1.1/24, Area 0
Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 10
Transmit Delay is 1 sec, State DR, Priority 255
Designated Router (ID) 1.1.1.1, Interface address 123.1.1.1
Backup Designated router (ID) 2.2.2.2, Interface address 123.1.1.2
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
Hello due in 00:00:06
Supports Link-local Signaling (LLS)
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 1, maximum is 4
Last flood scan time is 0 msec, maximum is 4 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 2.2.2.2 (Backup Designated Router)
Suppress hello for 0 neighbor(s)
Message digest authentication enabled
Youngest key id is 1
目前使用的key id是1，那么密钥就是cisco
更改密钥
interface Ethernet0/0
ip address 123.1.1.1 255.255.255.0
ip ospf message-digest-key 1 md5 cisco
ip ospf message-digest-key 2 md5 cisco123
查看现在认证情况
R1#show ip os int e0/0
Ethernet0/0 is up, line protocol is up
Internet Address 123.1.1.1/24, Area 0
Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 10
Transmit Delay is 1 sec, State DR, Priority 255
Designated Router (ID) 1.1.1.1, Interface address 123.1.1.1
Backup Designated router (ID) 2.2.2.2, Interface address 123.1.1.2
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
Hello due in 00:00:08
Supports Link-local Signaling (LLS)
Index 1/1, flood queue length 0
Next 0x0(0)/0x0(0)
Last flood scan length is 1, maximum is 4
Last flood scan time is 0 msec, maximum is 4 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 2.2.2.2 (Backup Designated Router)
Suppress hello for 0 neighbor(s)
Message digest authentication enabled
Youngest key id is 2