實例講解RIP的認證
作者：佚名
Cisco支持使RIP認證有效的兩種接口認證模式:純文本認證 和MD5認證。RIP包的缺省認證模式為純文本認證。因為每一個RIP包發送的是未加密的認證值，為安全起見，RIP包不要使用純文本認證。當安全不成為問題時，例如確保設置的主機不參加路由選擇，可使用純文本認證。
RIP版本1不支持認證。如果接收和發送的是版本2包，接口能進行RIP認證。密鑰鏈路決定了能用于接口的一連串密鑰。如果不配設置密鑰鏈路，接口就不能進行認證，甚至不能進行缺省認證。下面就讓我們看一下配置RIP認證的步驟：
一、實驗拓撲如圖：
二、明文驗證
1、明文認證時，被認證方發送key chian時，發送最低ID值的key，并且不攜帶ID；認證方接收到key后，和自己key chain的全部key進行比較，只要有一個key匹配就通過對被認證方的認證。
2、驗證
R1上配置為：
- key chain rip-key
- key 1
- key-string ccxx02
- !
- interface FastEthernet0/0
- ip address 192.168.12.1 255.255.255.0
- ip rip authentication key-chain rip-key
R2上配置為：
- key chain rip-key
- key 1
- key-string ccxx01
- key 2
- key-string ccxx02
- !
- interface FastEthernet0/0
- ip address 192.168.12.2 255.255.255.0
- ip rip authentication key-chain rip-key
3、路由器的路由表結果
- R1#show ip route
- Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
- D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
- N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
- E1 - OSPF external type 1, E2 - OSPF external type 2
- i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
- ia - IS-IS inter area, * - candidate default, U - per-user static route
- o - ODR, P - periodic downloaded static route
- Gateway of last resort is not set
- C 192.168.12.0/24 is directly connected, FastEthernet0/0
- C 192.168.1.0/24 is directly connected, Loopback0
- R2#show ip route
- Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
- D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
- N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
- E1 - OSPF external type 1, E2 - OSPF external type 2
- i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
- ia - IS-IS inter area, * - candidate default, U - per-user static route
- o - ODR, P - periodic downloaded static route
- Gateway of last resort is not set
- C 192.168.12.0/24 is directly connected, FastEthernet0/0
- R 192.168.1.0/24 [120/1] via 192.168.12.1, 00:00:15, FastEthernet0/0
- C 192.168.2.0/24 is directly connected, Loopback0
4、結論
三、密文認證
1、被認證方發送key時，發送最低ID值的key，并且攜帶了ID；認證方接收到key后，首先在自己key chain中查找是否具有相同ID的key，如果有相同ID的key并且key相同就通過認證，key值不同就不通過認證。如果沒有相同ID的key，就查找該ID往后的最近ID的key；如果沒有往后的ID，認證失敗。
2、驗證
R1上配置為：
- key chain rip-key
- key 1
- key-string ccxx02
- !
- interface FastEthernet0/0
- ip address 192.168.12.1 255.255.255.0
- ip rip authentication mode md5
- ip rip authentication key-chain rip-key
R2上配置為：
- key chain rip-key
- key 1
- key-string ccxx01
- key 2
- key-string ccxx02
- !
- interface FastEthernet0/0
- ip address 192.168.12.2 255.255.255.0
- ip rip authentication mode md5
- ip rip authentication key-chain rip-key
3、路由表的輸出結果為：
- R1#show ip route
- Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
- D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
- N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
- E1 - OSPF external type 1, E2 - OSPF external type 2
- i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
- ia - IS-IS inter area, * - candidate default, U - per-user static route
- o - ODR, P - periodic downloaded static route
- Gateway of last resort is not set
- C 192.168.12.0/24 is directly connected, FastEthernet0/0
- C 192.168.1.0/24 is directly connected, Loopback0
- R2#show ip route
- Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
- D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
- N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
- E1 - OSPF external type 1, E2 - OSPF external type 2
- i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
- ia - IS-IS inter area, * - candidate default, U - per-user static route
- o - ODR, P - periodic downloaded static route
- Gateway of last resort is not set
- C 192.168.12.0/24 is directly connected, FastEthernet0/0
- R 192.168.1.0/24 [120/1] via 192.168.12.1, 00:00:15, FastEthernet0/0
- C 192.168.2.0/24 is directly connected, Loopback0
4、結論
RIP認證的實驗就為大家介紹完了，希望大家已經掌握！
【編輯推薦】
責任編輯：佚名
來源：
Cisco技術網
