点到点多区域OSPF的安全认证和vritual-link(虚链路)的作用及配置.
一: 非主区域必须和主区域(area 0)直接相连才能于其它区域通信.如果不直接相连,则须使用virtual-link实现于其它区域通信.
二: 设备端口和区域若分别加上安全验证 ip ospf authentication-key password 和area area-id authentication 后,安全验证的端口将不与无验证的端口通信.
实验拓扑如下图所示:
R1:s0/0=1.0.0.1/24
R1:e1/0=192.168.1.1/24
R2:e1/0=192.168.2.1/24
R3:e1/0=192.168.3.1/24
R1:s0/1=2.0.0.1/24<-------->R2:s0/0= 2.0.0.2/24
R2:s0/1=3.0.0.1/24<-------->R3:s0/0= 3.0.0.2/24
当area3不和area0直接相连时,且之间又没建virtual-link(虚链路),则工area3无法与area0通信.
Router>
Router>en
Router#conf t
Router(config)#ho R1
R1(config)#int s0/0
R1(config-if)#ip add 1.0.0.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#int s0/1
R1(config-if)#ip add 2.0.0.1 255.255.255.0
R1(config-if)#clock rate 6400
R1(config-if)#no sh
R1(config)#int e1/0
R1(config-if)#ip add 192.168.1.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#exit
R1(config)#router ospf 1
R1(config-router)#network 1.0.0.0 0.0.0.255 area 0
R1(config-router)#network 192.168.1.0 0.0.0.255 area 0
R1(config-router)#network 2.0.0.0 0.0.0.255 area 1
R1(config-router)#end
R1#show ip route
1.0.0.0/32 is subnetted, 1 subnets
C 1.1.1.1 is directly connected, Loopback0
2.0.0.0/24 is subnetted, 1 subnets
C 2.0.0.0 is directly connected, Serial0/1
C 192.168.1.0/24 is directly connected, Ethernet1/0
O 192.168.2.0/24 [110/74] via 2.0.0.2, 00:09:31, Serial0/1
R1#show ip ospf
Routing Process "ospf 1" with ID 192.168.1.1
R2:
Router>en
Router#conf t
Router(config)#ho R2
R2(config)#int e1/0
R2(config-if)#ip add 192.168.2.1 255.255.255.0
R2(config-if)#no shut
R2(config-if)#int s0/0
R2(config-if)#ip add 2.0.0.2 255.255.255.0
R2(config-if)#clock rate 6400
R2(config-if)#no sh
R2(config-if)#int s0/1
R2(config-if)#ip add 3.0.0.1 255.255.255.0
R2(config-if)#clock rate 6400
%Clockrate bestfitted (rounded) to 6420
R2(config-if)#no sh
R2(config-if)#exit
R2(config)#router ospf 1
R2(config-router)#network 2.0.0.0 0.0.0.255 area 1
R2(config-router)#network 3.0.0.0 0.0.0.255 area 2
R2(config-router)#nwtwork 192.168.2.0 0.0.0.255 area 1
R2(config-router)#network 192.168.2.0 0.0.0.255 area 1
R2(config-router)#end
R2#show ip route
Gateway of last resort is not set
2.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 2.2.2.2/32 is directly connected, Loopback0
C 2.0.0.0/24 is directly connected, Serial0/0
3.0.0.0/24 is subnetted, 1 subnets
C 3.0.0.0 is directly connected, Serial0/1
O IA 192.168.1.0/24 [110/74] via 2.0.0.1, 00:01:17, Serial0/0
C 192.168.2.0/24 is directly connected, Ethernet1/0
O 192.168.3.0/24 [110/74] via 3.0.0.2, 00:01:17, Serial0/1
R2#show ip ospf
Routing Process "ospf 1" with ID 192.168.2.1
Router>en
Router#conf t
Router(config)#ho R3
R3(config)#int e1/0
R3(config-if)#ip add 192.168.3.1 255.255.255.0
R3(config-if)#no sh
R3(config-if)#int s0/0
R3(config-if)#ip add 3.0.0.2 255.255.255.0
R3(config-if)#clock rate 6400
%Clockrate bestfitted (rounded) to 6420
R3(config-if)#no sh
R3(config-if)#exit
R3(config)#route ospf 1
R3(config)#router ospf 1
R3(config-router)#network 3.0.0.0 0.0.0.255 area 2
R3(config-router)#network 192.168.3.0 0.0.0.255 area 2
R3(config-router)#end
R3#show ip route
Gateway of last resort is not set
3.0.0.0/24 is subnetted, 2 subnets
C 3.3.3.0 is directly connected, Loopback0
C 3.0.0.0 is directly connected, Serial0/0
C 192.168.3.0/24 is directly connected, Ethernet1/0
R3#show ip ospf
Routing Process "ospf 1" with ID 192.168.3.1
PC1能ping 通192.168.2.1, 2.0.0.2
PC1>ping 192.168.2.1
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 112/308/528 ms
PC1>ping 2.0.0.2
Sending 5, 100-byte ICMP Echos to 2.0.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 112/250/476 ms
PC1 ping 不通3.0.0.1,192.168.3.1
PC2 也PING 不通3.0.0.1,192.168.3.1
PC1>ping 3.0.0.1
Sending 5, 100-byte ICMP Echos to 3.0.0.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
PC1>ping 192.168.3.1
Sending 5, 100-byte ICMP Echos to 3.0.0.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
利用安全验证:area area-id authentication
没有加入验证的端口或区域将不能与外界通信.
若不将R1的s0/0端口设置安全验证.其它的都设置.则R1:s0/0端口无法与需要验证的设备端口通信.
设置如下:
R1(config)#int s0/1
R1(config-if)#ip ospf authentication-key cisco
R1(config)#int e1/0
R1(config-if)#ip ospf authentication-key cisco
R1(config)#router ospf 1
R1(config-router)#area 0 authentication
R1(config-router)#area 1 authentication
R1(config-router)#end
R2(config)#int s0/1
R2(config-if)#ip ospf authentication-key cisco
R2(config-if)#int s0/0
R2(config-if)#ip ospf authentication-key cisco
R2(config)#int e1/0
R2(config-if)#ip ospf authentication-key cisco
R2(config-if)#exit
R2(config)#router ospf 1
R2(config-router)#area 1 authen
R2(config-router)#area 2 authen
PC2#ping 2.0.0.1
Sending 5, 100-byte ICMP Echos to 2.0.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/216/320 ms
PC2#ping 192.168.1.1
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/173/296 ms
PC2#ping 1.0.0.1
Sending 5, 100-byte ICMP Echos to 1.0.0.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5) PC2 ping 不通1.0.0.1
当在area0与area2 之间加入虚链路 如下:
R1(config)#router ospf 1
R2(config-router)#area 1 virtual-link 192.168.11 authen authentication-key cisco
/*在area0与area2之间建立虚连接并加入安全验证. area1表示Virtual-link所经过的区域*/
R2(config-router)#end
R2(config)#router ospf 1
R2(config-router)#area 1 virtual-link 192.168.1.1 authen authentication-key cisco
/*在area0与area2之间建立虚连接并加入安全验证. area1表示Virtual-link所经过的区域*/
R3(config-router)#end
此时:PC1.PC2 均能PING通area2中的设备.
PC1#ping 3.0.0.1
Sending 5, 100-byte ICMP Echos to 3.0.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 44/113/212 ms
PC1#ping 192.168.3.1
Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 248/487/708 ms
PC2:
PC2#ping 192.168.3.1
Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 104/189/316 ms
PC2#ping 3.0.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.0.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 128/192/284 ms
