DynagenでCCIEを目指す

20100405 rip 認証の設定

最終更新：2010年04月10日 13:20

it_certification

- view

管理者のみ編集可

目的
構成
検証1 設定の確認
検証2 key-chainの設定
検証3 md5ハッシュ化

目的

RIPの認証設定方法を確認します。

構成

設定概要
- R1とR2に同一の認証キーFOOを設定します。
- R3に認証キーBAAを設定します。R3は、R1,R2とキーが異なるため経路を交換する事ができません。
構成図

netファイル

ghostios = True
sparsemem = True
model = 3620
[localhost]
	
	[[3620]]
		image = C:\Program Files\Dynamips\images\c3620-j1s3-mz.123-18.bin
		ram = 256
	
	[[ROUTER R1]]
		e0/0 = LAN 1
		
	[[ROUTER R2]]
		e0/0 = LAN 1
	
	[[ROUTER R3]]
		e0/0 = LAN 1

初期設定 R1

!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
ip cef
!
!
key chain HOGE
 key 1
  key-string FOO
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
 ip address 192.168.0.1 255.255.255.0
 ip rip authentication key-chain HOGE
 full-duplex
!
interface Ethernet0/1
 ip address 192.168.1.1 255.255.255.0
 full-duplex
 no keepalive
!
interface Ethernet0/2
 no ip address
 shutdown
 half-duplex
!
interface Ethernet0/3
 no ip address
 shutdown
 half-duplex
!
router rip
 version 2
 network 192.168.0.0
 network 192.168.1.0
 no auto-summary
!
ip http server
ip classless
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
!
end

初期設定 R2

!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
ip cef
!
!
key chain HOGE
 key 1
  key-string FOO
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
 ip address 192.168.0.2 255.255.255.0
 ip rip authentication key-chain HOGE
 full-duplex
!
interface Ethernet0/1
 ip address 192.168.2.2 255.255.255.0
 full-duplex
 no keepalive
!
interface Ethernet0/2
 no ip address
 shutdown
 half-duplex
!
interface Ethernet0/3
 no ip address
 shutdown
 half-duplex
!
router rip
 version 2
 network 192.168.0.0
 network 192.168.2.0
 no auto-summary
!
ip http server
ip classless
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
!
end

初期設定 R3

!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
ip cef
!
!
key chain HOGE
 key 1
  key-string BAA
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
 ip address 192.168.0.3 255.255.255.0
 ip rip authentication key-chain HOGE
 full-duplex
 no keepalive
!
interface Ethernet0/1
 ip address 192.168.3.3 255.255.255.0
 full-duplex
 no keepalive
!
interface Ethernet0/2
 no ip address
 shutdown
 half-duplex
!
interface Ethernet0/3
 no ip address
 shutdown
 half-duplex
!
router rip
 version 2
 network 192.168.0.0
 network 192.168.3.0
 no auto-summary
!
ip http server
ip classless
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
!
end

検証1 設定の確認

ルーティングテーブルの確認

R1, R2がR3と経路を交換できていない事が確認できます。

R1#show ip route
 - 略 -
C    192.168.0.0/24 is directly connected, Ethernet0/0
C    192.168.1.0/24 is directly connected, Ethernet0/1
R    192.168.2.0/24 [120/1] via 192.168.0.2, 00:00:22, Ethernet0/0

デバッグメッセージの確認

R1のデバッグメッセージを確認します。R3からのRIP updateに対し、「invalid authentication」と表記されている事が確認できます。

R1#debug ip rip
RIP protocol debugging is on
R1#
*Mar  1 00:26:23.083: RIP: sending v2 update to 224.0.0.9 via Ethernet0/1 (192.168.1.1)
*Mar  1 00:26:23.083: RIP: build update entries
*Mar  1 00:26:23.083:   192.168.0.0/24 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:26:23.083:   192.168.2.0/24 via 0.0.0.0, metric 2, tag 0
*Mar  1 00:26:38.291: RIP: received packet with text authentication BAA
*Mar  1 00:26:38.295: RIP: ignored v2 packet from 192.168.0.3 (invalid authentication)
*Mar  1 00:26:42.275: RIP: received packet with text authentication FOO
*Mar  1 00:26:42.279: RIP: received v2 update from 192.168.0.2 on Ethernet0/0
*Mar  1 00:26:42.279:      192.168.2.0/24 via 0.0.0.0 in 1 hops
*Mar  1 00:26:42.315: RIP: sending v2 update to 224.0.0.9 via Ethernet0/0 (192.168.0.1)
*Mar  1 00:26:42.315: RIP: build update entries
*Mar  1 00:26:42.315:   192.168.1.0/24 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:26:50.775: RIP: sending v2 update to 224.0.0.9 via Ethernet0/1 (192.168.1.1)
*Mar  1 00:26:50.775: RIP: build update entries
*Mar  1 00:26:50.779:   192.168.0.0/24 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:26:50.779:   192.168.2.0/24 via 0.0.0.0, metric 2, tag 0

パケットの確認

R1 e0/0に対してパケットキャプチャを設定します。平文でパスワードを送信しているパケットを確認する事ができます。

検証2 key-chainの設定

キー有効期限の設定

認証キーに対して有効期限を設ける方法を確認します。
前準備として、ルータに設定された時刻をshow clockコマンドで確認します。

R1#show clock
*00:29:26.407 UTC Mon Mar 1 1993

R1に対し、現在時刻の数分後(0時30分を600秒後)にキーがFOOからBAAに変わるように設定します。

R1(config)#key chain HOGE
R1(config-keychain)#key 1
R1(config-keychain-key)#key-string FOO
R1(config-keychain-key)#accept-lifetime 00:30:00 Mar 1 1993 duration 600
R1(config-keychain-key)#send-lifetime 00:30:00 Mar 1 1993 duration 600
R1(config-keychain-key)#exit
R1(config-keychain)#key 2
R1(config-keychain-key)#key-string BAA
R1(config-keychain-key)#accept-lifetime 00:40:00 Mar 1 1993 infinite
R1(config-keychain-key)#send-lifetime 00:40:00 Mar 1 1993 infinite

デバッグメッセージの確認

0時40分を境に認証キーが変わる様子が確認できます。今までR2と経路を交換していたR1が、0時40分を境にR3と経路を交換している事が確認できます。

*Mar  1 00:39:42.095: RIP: received packet with text authentication BAA
*Mar  1 00:39:42.099: RIP: ignored v2 packet from 192.168.0.3 (invalid authentication)        <- R3からのupdateを拒否
*Mar  1 00:39:42.247: RIP: sending v2 update to 224.0.0.9 via Ethernet0/1 (192.168.1.1)
*Mar  1 00:39:42.247: RIP: build update entries
*Mar  1 00:39:42.247:   192.168.0.0/24 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:39:42.247:   192.168.2.0/24 via 0.0.0.0, metric 2, tag 0
*Mar  1 00:39:48.319: RIP: sending v2 update to 224.0.0.9 via Ethernet0/0 (192.168.0.1)
*Mar  1 00:39:48.319: RIP: build update entries
*Mar  1 00:39:48.323:   192.168.1.0/24 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:39:58.795: RIP: received packet with text authentication FOO
*Mar  1 00:39:58.799: RIP: received v2 update from 192.168.0.2 on Ethernet0/0                 <- R2からのupdateを許可
*Mar  1 00:39:58.799:      192.168.2.0/24 via 0.0.0.0 in 1 hops
*Mar  1 00:40:08.391: RIP: received packet with text authentication BAA
*Mar  1 00:40:08.395: RIP: received v2 update from 192.168.0.3 on Ethernet0/0                 <- R3からのupdateを許可
*Mar  1 00:40:08.395:      192.168.3.0/24 via 0.0.0.0 in 1 hops
*Mar  1 00:40:10.399: RIP: sending v2 flash update to 224.0.0.9 via Ethernet0/0 (192.168.0.1)
*Mar  1 00:40:10.399: RIP: build flash update entries - suppressing null update
*Mar  1 00:40:10.403: RIP: sending v2 flash update to 224.0.0.9 via Ethernet0/1 (192.168.1.1)
*Mar  1 00:40:10.403: RIP: build flash update entries
*Mar  1 00:40:10.403:   192.168.3.0/24 via 0.0.0.0, metric 2, tag 0
*Mar  1 00:40:11.739: RIP: sending v2 update to 224.0.0.9 via Ethernet0/1 (192.168.1.1)
*Mar  1 00:40:11.739: RIP: build update entries
*Mar  1 00:40:11.743:   192.168.0.0/24 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:40:11.743:   192.168.2.0/24 via 0.0.0.0, metric 2, tag 0
*Mar  1 00:40:11.747:   192.168.3.0/24 via 0.0.0.0, metric 2, tag 0
*Mar  1 00:40:16.763: RIP: sending v2 update to 224.0.0.9 via Ethernet0/0 (192.168.0.1)
*Mar  1 00:40:16.763: RIP: build update entries
*Mar  1 00:40:16.763:   192.168.1.0/24 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:40:24.747: RIP: received packet with text authentication FOO
*Mar  1 00:40:24.751: RIP: ignored v2 packet from 192.168.0.2 (invalid authentication)        <- R2からのupdateを拒否

ルーティングテーブルの確認

R1のルーティングテーブルを確認します。R2からのupdateを拒否し、R3からのupdateを受け入れている様子が読み取れます。

R1#show ip route
 - 略 -
C    192.168.0.0/24 is directly connected, Ethernet0/0
C    192.168.1.0/24 is directly connected, Ethernet0/1
R    192.168.2.0/24 is possibly down, routing via 192.168.0.2, Ethernet0/0 <- R2への経路はdown
R    192.168.3.0/24 [120/1] via 192.168.0.3, 00:00:15, Ethernet0/0         <- R3への経路が新たに加わる

検証3 md5ハッシュ化

ハッシュ化の設定

認証キーをハッシュ化する方法を確認します。R1, R3に対し以下の設定を投入します。

R1(config)#interface Ethernet 0/0
R1(config-if)#ip rip authentication mode md5

R3(config)#interface Ethernet 0/0
R3(config-if)#ip rip authentication mode md5

デバッグメッセージの確認

検証1の時と異なりキーがデバッグメッセージで表示されません。「MD5 authentication」との表示が確認できます。

R1#debug ip rip
RIP protocol debugging is on
R1#
*Mar  1 00:46:02.419: RIP: received packet with MD5 authentication
*Mar  1 00:46:02.423: RIP: received v2 update from 192.168.0.3 on Ethernet0/0
*Mar  1 00:46:02.423:      192.168.3.0/24 via 0.0.0.0 in 1 hops
*Mar  1 00:46:05.575: RIP: ignored v2 packet from 192.168.0.2 (invalid authentication)
*Mar  1 00:46:18.447: RIP: sending v2 update to 224.0.0.9 via Ethernet0/0 (192.168.0.1)
*Mar  1 00:46:18.447: RIP: build update entries
*Mar  1 00:46:18.451:   192.168.1.0/24 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:46:19.451: RIP: sending v2 update to 224.0.0.9 via Ethernet0/1 (192.168.1.1)
*Mar  1 00:46:19.451: RIP: build update entries
*Mar  1 00:46:19.455:   192.168.0.0/24 via 0.0.0.0, metric 1, tag 0
*Mar  1 00:46:19.455:   192.168.3.0/24 via 0.0.0.0, metric 2, tag 0
*Mar  1 00:46:28.943: RIP: received packet with MD5 authentication
*Mar  1 00:46:28.947: RIP: received v2 update from 192.168.0.3 on Ethernet0/0
*Mar  1 00:46:28.947:      192.168.3.0/24 via 0.0.0.0 in 1 hops