OSPF MD5認証 Cisco IOS

概要

Cisco IOSでのOSPFのMD5認証の設定方法を紹介します。

ネットワーク構成図

MD5認証の設定には、、エリア単位に設定す方法と、インターフェイス単位に設定する方法の2種類の指定方法があります。今回はR1はエリア単位に設定、R2はインターフェイス単位にMD5の範囲を指定します。

設定するMD5認証は「Key-ID　1　」、「認証パスワード　Ｃｉｓｃｏ　」を設定します。

エリア単位でのMD5認証設定(IOS-R1)

下記Area単位での認証設定は下記になります。該当エリアのOSPFインターフェイスはMD5認証の設定が必要になります。

IOS-R1(config)#router ospf PROCESS-ID
IOS-R1(config-router)#area AREA-ID authentication message-digest

1 2	IOS-R1(config)#router ospf PROCESS-ID IOS-R1(config-router)#area AREA-ID authentication message-digest

認証に利用するKey-IDおよび認証パスワードは下記で設定します。

IOS-R1(config-if)#ip ospf message-digest-key KEY-ID md5 PASSWORD

1	IOS-R1(config-if)#ip ospf message-digest-key KEY-ID md5 PASSWORD

コマンド引数	説明
KEY-ID	キーＩＤを設定します。 1-255 の範囲で指定します。
PASSWORD	MD5のパスワードを指定します。

ネットワーク構成図を元にIOS-R1にMD5認証設定

IOS-R1(config)#router ospf 1
IOS-R1(config-router)#area 0 authentication message-digest
IOS-R1(config-router)#exit
IOS-R1(config)#interface gigabitEthernet 0/1
IOS-R1(config-if)#ip ospf message-digest-key 1 md5 Cisco

IOS-R1(config)#router ospf 1

IOS-R1(config-router)#area 0 authentication message-digest

IOS-R1(config-router)#exit

IOS-R1(config)#interface gigabitEthernet 0/1

IOS-R1(config-if)#ip ospf message-digest-key 1 md5 Cisco

インターフェイス単位でのMD5認証設定(IOS-R2)

下記コマンドで該当インターフェイスがMD5認証が有効になります。

IOS-R2(config)#interface INTERFACE-NAME
IOS-R2(config-if)#ip ospf authentication message-digest

1 2	IOS-R2(config)#interface INTERFACE-NAME IOS-R2(config-if)#ip ospf authentication message-digest

認証に利用するKey-IDおよび認証パスワードは下記で設定します。(先ほど紹介した設定方法と同じになります。)

IOS-R1(config-if)#ip ospf message-digest-key KEY-ID md5 PASSWORD

1	IOS-R1(config-if)#ip ospf message-digest-key KEY-ID md5 PASSWORD

コマンド引数	説明
KEY-ID	キーＩＤを設定します。 1-255 の範囲で指定します。
PASSWORD	MD5のパスワードを指定します。

ネットワーク構成図を元にIOS-R2にMD5認証設定

IOS-R2(config)#interface gigabitEthernet 0/1
IOS-R2(config-if)#ip ospf authentication message-digest
IOS-R2(config-if)#ip ospf message-digest-key 1 md5 Cisco

IOS-R2(config)#interface gigabitEthernet 0/1

IOS-R2(config-if)#ip ospf authentication message-digest

IOS-R2(config-if)#ip ospf message-digest-key 1 md5 Cisco

設定後のコマンド確認

IOS-R1は下記でエリア単位でMD5認証が設定されていることがわかります。

IOS-R1#show ip ospf
 Routing Process "ospf 1" with ID 1.1.1.1
 Start time: 00:02:17.343, Time elapsed: 00:22:37.532
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 Supports Link-local Signaling (LLS)
 Supports area transit capability
 Supports NSSA (compatible with RFC 3101)
 Supports Database Exchange Summary List Optimization (RFC 5243)
 Event-log enabled, Maximum number of events: 1000, Mode: cyclic
 Router is not originating router-LSAs with maximum metric
 Initial SPF schedule delay 5000 msecs
 Minimum hold time between two consecutive SPFs 10000 msecs
 Maximum wait time between two consecutive SPFs 10000 msecs
 Incremental-SPF disabled
 Minimum LSA interval 5 secs
 Minimum LSA arrival 1000 msecs
 LSA group pacing timer 240 secs
 Interface flood pacing timer 33 msecs
 Retransmission pacing timer 66 msecs
 EXCHANGE/LOADING adjacency limit: initial 300, process maximum 300
 Number of external LSA 0. Checksum Sum 0x000000
 Number of opaque AS LSA 0. Checksum Sum 0x000000
 Number of DCbitless external and opaque AS LSA 0
 Number of DoNotAge external and opaque AS LSA 0
 Number of areas in this router is 1. 1 normal 0 stub 0 nssa
 Number of areas transit capable is 0
 External flood list length 0
 IETF NSF helper support enabled
 Cisco NSF helper support enabled
 Reference bandwidth unit is 100 mbps
    Area BACKBONE(0) (Inactive)
        Number of interfaces in this area is 2 (1 loopback)
	Area has message digest authentication
	SPF algorithm last executed 00:15:36.552 ago
	SPF algorithm executed 1 times
	Area ranges are
	Number of LSA 1. Checksum Sum 0x00D9D1
	Number of opaque link LSA 0. Checksum Sum 0x000000
	Number of DCbitless LSA 0
	Number of indication LSA 0
	Number of DoNotAge LSA 0
	Flood list length 0

IOS-R1#

IOS-R1#show ip ospf

Routing Process "ospf 1" with ID 1.1.1.1

Start time: 00:02:17.343, Time elapsed: 00:22:37.532

Supports only single TOS(TOS0) routes

Supports opaque LSA

Supports Link-local Signaling (LLS)

Supports area transit capability

Supports NSSA (compatible with RFC 3101)

Supports Database Exchange Summary List Optimization (RFC 5243)

Event-log enabled, Maximum number of events: 1000, Mode: cyclic

Router is not originating router-LSAs with maximum metric

Initial SPF schedule delay 5000 msecs

Minimum hold time between two consecutive SPFs 10000 msecs

Maximum wait time between two consecutive SPFs 10000 msecs

Incremental-SPF disabled

Minimum LSA interval 5 secs

Minimum LSA arrival 1000 msecs

LSA group pacing timer 240 secs

Interface flood pacing timer 33 msecs

Retransmission pacing timer 66 msecs

EXCHANGE/LOADING adjacency limit: initial 300, process maximum 300

Number of external LSA 0. Checksum Sum 0x000000

Number of opaque AS LSA 0. Checksum Sum 0x000000

Number of DCbitless external and opaque AS LSA 0

Number of DoNotAge external and opaque AS LSA 0

Number of areas in this router is 1. 1 normal 0 stub 0 nssa

Number of areas transit capable is 0

External flood list length 0

IETF NSF helper support enabled

Cisco NSF helper support enabled

Reference bandwidth unit is 100 mbps

Area BACKBONE(0) (Inactive)

Number of interfaces in this area is 2 (1 loopback)

Area has message digest authentication

SPF algorithm last executed 00:15:36.552 ago

SPF algorithm executed 1 times

Area ranges are

Number of LSA 1. Checksum Sum 0x00D9D1

Number of opaque link LSA 0. Checksum Sum 0x000000

Number of DCbitless LSA 0

Number of indication LSA 0

Number of DoNotAge LSA 0

Flood list length 0

IOS-R1#

IOS-R1,IOS-R2共にインターフェイスでのMD5の認証が有効になっていることがわかります。

IOS-R2#show ip ospf interface gigabitEthernet 0/1
GigabitEthernet0/1 is up, line protocol is up
  Internet Address 192.168.0.2/24, Area 0, Attached via Network Statement
  Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 1
  Topology-MTID    Cost    Disabled    Shutdown      Topology Name
        0           1         no          no            Base
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 2.2.2.2, Interface address 192.168.0.2
  No backup designated router on this network
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:01
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1/1, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 0, maximum is 0
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 0, Adjacent neighbor count is 0
  Suppress hello for 0 neighbor(s)
  Cryptographic authentication enabled
    Youngest key id is 1
IOS-R2#

IOS-R2#show ip ospf interface gigabitEthernet 0/1

GigabitEthernet0/1 is up, line protocol is up

Internet Address 192.168.0.2/24, Area 0, Attached via Network Statement

Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 1

Topology-MTID Cost Disabled Shutdown Topology Name

0 1 no no Base

Transmit Delay is 1 sec, State DR, Priority 1

Designated Router (ID) 2.2.2.2, Interface address 192.168.0.2

No backup designated router on this network

Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

oob-resync timeout 40

Hello due in 00:00:01

Supports Link-local Signaling (LLS)

Cisco NSF helper support enabled

IETF NSF helper support enabled

Index 1/1/1, flood queue length 0

Next 0x0(0)/0x0(0)/0x0(0)

Last flood scan length is 0, maximum is 0

Last flood scan time is 0 msec, maximum is 0 msec

Neighbor Count is 0, Adjacent neighbor count is 0

Suppress hello for 0 neighbor(s)

Cryptographic authentication enabled

Youngest key id is 1

IOS-R2#

Cisco IOS 設定方法記事一覧

基本設定

Cisco IOS 基本設定 (ホスト名、インターフェイス、staticなど）

インターネット接続

PPPoE

DS-Lite

DS-Lite (光電話なし）

OSPF

下記はOSPFのプロトコル解説

: ネットワーク解説 OSPF (Open Shortest Path First)

BGP

BGP基本設定

下記はBGPのプロトコル解説

: ネットワーク解説 BGP ( Border Gateway Protocol )