OSPF认证

在OSPF进程中配置某个区域认证，在这个区域的所有接口都生效；在接口下配置认证，只在这个接口下生效，这是一个快速配置多个接口的方法，若两者都有，接口下优先。（见附1）

两台建立好邻居关系的路由器

R1#show ip ospf neighbor 

Neighbor ID     Pri   State           Dead Time   Address         Interface

22.2.2.2          1   FULL/DR         00:00:05    12.1.1.2        FastEthernet0/0 

在R1上配置认证，R2上没配，邻居关系会断开

R1#show ip ospf neighbor 无显示

R1#show ip ospf interface f0/0

FastEthernet0/0 is up, line protocol is up 

  Internet Address 12.1.1.1/24, Area 0 

  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1

  Transmit Delay is 1 sec, State DR, Priority 1 

  Designated Router (ID) 1.1.1.1, Interface address 12.1.1.1

  No backup designated router on this network

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:02

  Supports Link-local Signaling (LLS)

  Index 3/3, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 1

  Last flood scan time is 0 msec, maximum is 0 msec

  Neighbor Count is 0, Adjacent neighbor count is 0 

  Suppress hello for 0 neighbor(s)

  Message digest authentication enabled

    Youngest key id is 1

R1显示指定路由器是自己。没有备份路由器，已显示认证信息，开启认证，密钥为1

R2#show ip ospf interface f0/0

FastEthernet0/0 is up, line protocol is up 

  Internet Address 12.1.1.2/24, Area 0 

  Process ID 2, Router ID 22.2.2.2, Network Type BROADCAST, Cost: 1

  Transmit Delay is 1 sec, State DR, Priority 1 

  Designated Router (ID) 22.2.2.2, Interface address 12.1.1.2

  No backup designated router on this network

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:00

  Supports Link-local Signaling (LLS)

  Index 2/2, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 1

  Last flood scan time is 0 msec, maximum is 4 msec

  Neighbor Count is 0, Adjacent neighbor count is 0 

  Suppress hello for 0 neighbor(s)

  Message digest authentication enabled

      No key configured, using default key id 0

      

 R2显示指定路由器是自己。没有备份路由器，已显示认证信息，开启认证，密钥为0（空密码）

在R2上配置密钥后

R2(config-if)#ip ospf message-digest-key 1 md5 cisco

邻居关系重新建立

R1#show ip ospf neighbor      

Neighbor ID     Pri   State           Dead Time   Address         Interface

22.2.2.2          1   FULL/DR         00:00:37    12.1.1.2        FastEthernet0/0

R1#

R1#show ip ospf interface f0/0

FastEthernet0/0 is up, line protocol is up 

  Internet Address 12.1.1.1/24, Area 0 

  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1

  Transmit Delay is 1 sec, State BDR, Priority 1 

  Designated Router (ID) 22.2.2.2, Interface address 12.1.1.2

  Backup Designated router (ID) 1.1.1.1, Interface address 12.1.1.1

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:08

  Supports Link-local Signaling (LLS)

  Index 3/3, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 1

  Last flood scan time is 4 msec, maximum is 4 msec

  Neighbor Count is 1, Adjacent neighbor count is 1 

    Adjacent with neighbor 22.2.2.2  (Designated Router)

  Suppress hello for 0 neighbor(s)

  Message digest authentication enabled

    Youngest key id is 1

R1#

R2#show ip ospf neighbor 

Neighbor ID     Pri   State           Dead Time   Address         Interface

1.1.1.1           1   FULL/BDR        00:00:36    12.1.1.1        FastEthernet0/0

3.3.3.3           0   FULL/  -           -        23.1.1.3        OSPF_VL0

3.3.3.3           0   FULL/  -        00:00:36    23.1.1.3        Serial1/0.23

R2#

R2#show ip ospf interface f0/0

FastEthernet0/0 is up, line protocol is up 

  Internet Address 12.1.1.2/24, Area 0 

  Process ID 2, Router ID 22.2.2.2, Network Type BROADCAST, Cost: 1

  Transmit Delay is 1 sec, State DR, Priority 1 

  Designated Router (ID) 22.2.2.2, Interface address 12.1.1.2

  Backup Designated router (ID) 1.1.1.1, Interface address 12.1.1.1

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:03

  Supports Link-local Signaling (LLS)

  Index 2/2, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 1

  Last flood scan time is 0 msec, maximum is 4 msec

  Neighbor Count is 1, Adjacent neighbor count is 1 

    Adjacent with neighbor 1.1.1.1  (Backup Designated Router)

  Suppress hello for 0 neighbor(s)

  Message digest authentication enabled

    Youngest key id is 1

    

    

疑问：为何建立邻接关系后的DR还是R2？

附一段debug信息，设计DR选举，邻居建立。（R1已开启，R2开启认证后）

R1#debug ip ospf events

R1#debug ip ospf adj

R1#debug ip ospf packet

这三条debug命令区别

debug ip ospf packet 

调试ip ospf 数据包。输出的只是收到的包的信息，不涉及发送的包，只列出包头的各字段，并没有解读，不涉及其他信息，一般不用打开。

debug ip ospf events

调试ospf事件,显示发送，接受hello（已解读），邻居改变事件，DR选取，

显示建立邻接关系的过程，比debug ip ospf adj，多了显示 发送接收hello数据包

debug ip ospf adj

调试OSPF邻接信息

显示邻接关系的建立过程。比debug ip ospf events 更加简洁，只显示邻接建立。

显示，发送认证密钥的情况（每隔10S，hello包），如果（收到的数据包）密钥不匹配 ，会提示；

没有配置认证的话，无输出。一般只用这个就可以了。

R1#

//R2还未配置认证密钥时，R1每隔10秒发送一次hello包，企图建立邻居关系，hello包中包含自己已配置的密钥。（仅在f0/0s上配置，f1/0未配置）

*Mar  1 00:41:52.223: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet1/0 from 10.1.1.1

*Mar  1 00:41:52.307: OSPF: Send with youngest Key 1

*Mar  1 00:41:52.307: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 12.1.1.1

R1#

//R1收到Hello包，发现认证密钥并不匹配（R1配了密钥，R2还没配）

*Mar  1 00:41:54.451: OSPF: Rcv pkt from 12.1.1.2, FastEthernet0/0 : Mismatch Authentication Key - No message digest key 0 on interface

R1#

R1#

*Mar  1 00:42:02.227: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet1/0 from 10.1.1.1

*Mar  1 00:42:02.311: OSPF: Send with youngest Key 1

*Mar  1 00:42:02.311: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 12.1.1.1

*Mar  1 00:42:02.367: OSPF: rcv. v:2 t:1 l:48 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE1C from FastEthernet0/0

*Mar  1 00:42:02.371: OSPF: Rcv hello from 22.2.2.2 area 0 from FastEthernet0/0 12.1.1.2

*Mar  1 00:42:02.375: OSPF: 2 Way Communication to 22.2.2.2 on FastEthernet0/0, state 2WAY

*Mar  1 00:42:02.379: OSPF: Neighbor change Event on interface FastEthernet0/0

*Mar  1 00:42:02.379: OSPF: DR/BDR election on FastEthernet0/0 

*Mar  1 00:42:02.383: OSPF: Elect BDR 0.0.0.0

*Mar  1 00:42:02.383: OSPF: Elect DR 22.2.2.2

*Mar  1 00:42:02.387: OSPF: Elect BDR 1.1.1.1

*Mar  1 00:42:02.387: OSPF: Elect DR 22.2.2.2

*Mar  1 00:42:02.391:        DR: 22.2.2.2 (Id)   BDR: 1.1.1.1 (Id)

*Mar  1 00:42:02.391: OSPF: Send DBD to 22.2.2.2 on FastEthernet0/0 seq 0x122C opt 0x52 flag 0x7 len 32

*Mar  1 00:42:02.395: OSPF: Send with youngest Key 1

*Mar  1 00:42:02.395: OSPF: Set FastEthernet0/0 flush timer

*Mar  1 00:42:02.395: OSPF: Remember old DR 1.1.1.1 (id)

*Mar  1 00:42:02.399: OSPF: Neighbor change Event on interface FastEthernet0/0

*Mar  1 00:42:02.399: OSPF: DR/BDR election on FastEthernet0/0 

*Mar  1 00:42:02.403: OSPF: Elect BDR 1.1.1.1

*Mar  1 00:42:02.403: OSPF: Elect DR 22.2.2.2

*Mar  1 00:42:02.407:        DR: 22.2.2.2 (Id)   BDR: 1.1.1.1 (Id)

*Mar  1 00:42:02.407: OSPF: Send immediate hello to nbr 22.2.2.2, src address 12.1.1.2, on FastEthernet0/0

*Mar  1 00:42:02.411: OSPF: Send with youngest Key 1

*Mar  1 00:42:02.411: OSPF: Send hello to 12.1.1.2 area 0 on FastEthernet0/0 from 12.1.1.1

*Mar  1 00:42:02.411: OSPF: End of hello processing

*Mar  1 00:42:02.431: OSPF: rcv. v:2 t:2 l:32 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE1C from FastEthernet0/0

*Mar  1 00:42:02.439: OSPF: Rcv DBD from 22.2.2.2 on FastEthernet0/0 seq 0x2460 opt 0x52 flag 0x7 len 32  mtu 1500 state EXSTART

*Mar  1 00:42:02.443: OSPF: NBR Negotiation Done. We are the SLAVE

*Mar  1 00:42:02.443: OSPF: Send DBD to 22.2.2.2 on FastEthernet0/0 seq 0x2460 opt 0x52 flag 0x2 len 232

*Mar  1 00:42:02.443: OSPF: Send with youngest Key 1

*Mar  1 00:42:02.451: OSPF: rcv. v:2 t:2 l:212 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE1C from FastEthernet0/0

*Mar  1 00:42:02.455: OSPF: Rcv DBD from 22.2.2.2 on FastEthernet0/0 seq 0x2461 opt 0x52 flag 0x3 len 212  mtu 1500 state EXCHANGE

*Mar  1 00:42:02.459: OSPF: Send DBD to 22.2.2.2 on FastEthernet0/0 seq 0x2461 opt 0x52 flag 0x0 len 32

*Mar  1 00:42:02.463: OSPF: Send with youngest Key 1

*Mar  1 00:42:02.495: OSPF: rcv. v:2 t:2 l:32 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE1C from FastEthernet0/0

*Mar  1 00:42:02.503: OSPF: Rcv DBD from 22.2.2.2 on FastEthernet0/0 seq 0x2462 opt 0x52 flag 0x1 len 32  mtu 1500 state EXCHANGE

*Mar  1 00:42:02.503: OSPF: Exchange Done with 22.2.2.2 on FastEthernet0/0

*Mar  1 00:42:02.503: OSPF: Send LS REQ to 22.2.2.2 length 12 LSA count 1

*Mar  1 00:42:02.503: OSPF: Send with youngest Key 1

*Mar  1 00:42:02.503: OSPF: Send DBD to 22.2.2.2 on FastEthernet0/0 seq 0x2462 opt 0x52 flag 0x0 len 32

*Mar  1 00:42:02.503: OSPF: Send with youngest Key 1

*Mar  1 00:42:02.507: OSPF: rcv. v:2 t:3 l:48 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE1C from FastEthernet0/0

*Mar  1 00:42:02.515: OSPF: Rcv LS REQ from 22.2.2.2 on FastEthernet0/0 length 48 LSA count 2

*Mar  1 00:42:02.519: OSPF: Send with youngest Key 1

*Mar  1 00:42:02.519: OSPF: Send UPD to 12.1.1.2 on FastEthernet0/0 length 96 LSA count 2

*Mar  1 00:42:02.559: OSPF: rcv. v:2 t:4 l:88 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE1C from FastEthernet0/0

*Mar  1 00:42:02.563: OSPF: rcv. v:2 t:4 l:60 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE1C from FastEthernet0/0

*Mar  1 00:42:02.567: OSPF: Rcv LS UPD from 22.2.2.2 on FastEthernet0/0 length 88 LSA count 1

*Mar  1 00:42:02.571: OSPF: Synchronized with 22.2.2.2 on FastEthernet0/0, state FULL

*Mar  1 00:42:02.575: %OSPF-5-ADJCHG: Process 1, Nbr 22.2.2.2 on FastEthernet0/0 from LOADING to FULL, Loading Done

*Mar  1 00:42:02.579: OSPF: Rcv LS UPD from 22.2.2.2 on FastEthernet0/0 length 60 LSA count 1

*Mar  1 00:42:02.899: OSPF: Reset old DR on FastEthernet0/0

*Mar  1 00:42:02.903: OSPF: Send with youngest Key 1

*Mar  1 00:42:02.903: OSPF: Build router LSA for area 0, router ID 1.1.1.1, seq 0x80000008

*Mar  1 00:42:02.963: OSPF: rcv. v:2 t:4 l:88 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE1D from FastEthernet0/0

*Mar  1 00:42:02.971: OSPF: Rcv LS UPD from 22.2.2.2 on FastEthernet0/0 length 88 LSA count 1

*Mar  1 00:42:04.427: OSPF: rcv. v:2 t:1 l:48 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE1E from FastEthernet0/0

*Mar  1 00:42:04.431: OSPF: Rcv hello from 22.2.2.2 area 0 from FastEthernet0/0 12.1.1.2

*Mar  1 00:42:04.435: OSPF: Neighbor change Event on interface FastEthernet0/0

*Mar  1 00:42:04.439: OSPF: DR/BDR election on FastEthernet0/0 

*Mar  1 00:42:04.439: OSPF: Elect BDR 1.1.1.1

*Mar  1 00:42:04.439: OSPF: Elect DR 22.2.2.2

*Mar  1 00:42:04.443:        DR: 22.2.2.2 (Id)   BDR: 1.1.1.1 (Id)

*Mar  1 00:42:04.447: OSPF: End of hello processing

*Mar  1 00:42:05.035: OSPF: rcv. v:2 t:5 l:84 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE1F from FastEthernet0/0

*Mar  1 00:42:05.079: OSPF: Send with youngest Key 1

*Mar  1 00:42:07.531: OSPF: rcv. v:2 t:4 l:60 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE21 from FastEthernet0/0

*Mar  1 00:42:07.539: OSPF: Rcv LS UPD from 22.2.2.2 on FastEthernet0/0 length 60 LSA count 1

*Mar  1 00:42:10.043: OSPF: Send with youngest Key 1

R1#

R1#

*Mar  1 00:42:12.231: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet1/0 from 10.1.1.1

*Mar  1 00:42:12.315: OSPF: Send with youngest Key 1

*Mar  1 00:42:12.315: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 12.1.1.1

R1#

*Mar  1 00:42:14.443: OSPF: rcv. v:2 t:1 l:48 rid:22.2.2.2

      aid:0.0.0.0 chk:0 aut:2 keyid:1 seq:0x3C7ECE28 from FastEthernet0/0

*Mar  1 00:42:14.447: OSPF: Rcv hello from 22.2.2.2 area 0 from FastEthernet0/0 12.1.1.2

*Mar  1 00:42:14.451: OSPF: End of hello processing

附一

根据之前的实验，在R1，R2的f0/0下配置了认证，现在再在ospf进程下进行配置，之前在R2 f0/0上的配置并没有变化。在OSPF_VL0 接口下，显示空密码认证，正是刚在ospf下进行的配置，虚链路是area 0的接口，所以会在这个接口生效。

R2(config)#router ospf 2

R2(config-router)#area 0 authentication message-digest 

R2(config-router)#exit

R2(config)#end

R2#show ip ospf interface 

FastEthernet0/0 is up, line protocol is up 

  Internet Address 12.1.1.2/24, Area 0 

  Process ID 2, Router ID 22.2.2.2, Network Type BROADCAST, Cost: 1

  Transmit Delay is 1 sec, State BDR, Priority 1 

  Designated Router (ID) 1.1.1.1, Interface address 12.1.1.1

  Backup Designated router (ID) 22.2.2.2, Interface address 12.1.1.2

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:01

  Supports Link-local Signaling (LLS)

  Index 2/2, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 2, maximum is 2

  Last flood scan time is 0 msec, maximum is 4 msec

  Neighbor Count is 1, Adjacent neighbor count is 1 

    Adjacent with neighbor 1.1.1.1  (Designated Router)

  Suppress hello for 0 neighbor(s)

  Message digest authentication enabled

    Youngest key id is 1

Loopback22 is up, line protocol is up 

  Internet Address 22.2.2.2/24, Area 0 

  Process ID 2, Router ID 22.2.2.2, Network Type LOOPBACK, Cost: 1

  Loopback interface is treated as a stub Host

OSPF_VL0 is up, line protocol is up 

  Internet Address 23.1.1.2/24, Area 0 

  Process ID 2, Router ID 22.2.2.2, Network Type VIRTUAL_LINK, Cost: 64

  Configured as demand circuit.

  Run as demand circuit.

  DoNotAge LSA allowed.

  Transmit Delay is 1 sec, State POINT_TO_POINT,

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:01

  Supports Link-local Signaling (LLS)

  Index 1/1, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 1

  Last flood scan time is 0 msec, maximum is 4 msec

  Neighbor Count is 1, Adjacent neighbor count is 1 

    Adjacent with neighbor 3.3.3.3  (Hello suppressed)

  Suppress hello for 1 neighbor(s)

  Message digest authentication enabled

      No key configured, using default key id 0

Serial1/0.23 is up, line protocol is up 

  Internet Address 23.1.1.2/24, Area 1 

  Process ID 2, Router ID 22.2.2.2, Network Type POINT_TO_POINT, Cost: 64

  Transmit Delay is 1 sec, State POINT_TO_POINT,

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    oob-resync timeout 40

    Hello due in 00:00:03

  Supports Link-local Signaling (LLS)

  Index 1/4, flood queue length 0

  Next 0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 2

  Last flood scan time is 0 msec, maximum is 4 msec

  Neighbor Count is 1, Adjacent neighbor count is 1 

    Adjacent with neighbor 3.3.3.3

  Suppress hello for 0 neighbor(s)

R2#