ospf实验配置详解虚链路+链路认证+区域认证+特殊区域设置

padovan

已于 2024-08-05 16:16:32 修改

阅读量1.2k

点赞数

文章标签：网络协议网络运维 tcp/ip

于 2022-05-17 15:26:39 首次发布

本文链接：https://blog.csdn.net/qq_43210022/article/details/124785636

版权

本文详细介绍了OSPF实验配置，包括全网互通实现、链路认证、区域认证以及特殊区域（T-NSSA）的设置。在全网互通中，通过虚链路解决了孤岛区域问题。链路认证导致网络中断，通过配置明文认证恢复。区域认证则影响了虚链路，需确保虚链路设备参与区域认证。最后，将area2配置为T-NSSA区域，使其不学习全局路由。

摘要由CSDN通过智能技术生成

需求：1. 全网互通

2. area1做链路认证

3. area0做区域认证

步骤1:全网互通

1.1:ip地址配置

R1(config-router)#interface fa0/0
R1(config-if)#IP address 17.17.17.1 255.255.255.0
R1(config-if)#no shutdown
R1(config)#interface f0/1
R1(config-if)#ip address 14.14.14.1 255.255.255.0
R1(config-if)#no shutdown

R2(config-if)#interface f0/2
R2(config-if)#ip address 123.123.123.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#interface lo0
R2(config-if)#ip address 20.2.2.2 255.255.255.0

R3(config)#interface f0/3
R3(config-if)#ip address 123.123.123.3 255.255.255.0
R3(config-if)#no shutdown

R4(config)#interface f0/1
R4(config-if)#ip address 14.14.14.4 255.255.255.0
R4(config-if)#no shutdown
R4(config-if)#interface f0/4
R4(config-if)#ip address 123.123.123.4 255.255.255.0
R4(config-if)#no shutdown

R5(config)#interface f0/5
R5(config-if)#ip address 123.123.123.5 255.255.255.0
R5(config-if)#no shutdown
R5(config-if)#interface f0/6
R5(config-if)#ip address 56.56.56.5 255.255.255.0
R5(config-if)#no sh

R6(config)#interface f0/6
R6(config-if)#ip address 56.56.56.6 255.255.255.0
R6(config-if)#no shutdown
R6(config-if)#int loopback0
R6(config-if)#ip add 60.6.6.6 255.255.255.0

R7(config)#interface fa0/7
R7(config-if)#ip address 17.17.17.7 255.255.255.0
R7(config-if)#no shutdown

1.2 ospf配置

R1(config)#router ospf 1
R1(config-router)#router-id 1.1.1.1
R1(config-router)#network 14.14.14.0 0.0.0.255 area 1
R1(config-router)#network 17.17.17.0 0.0.0.255 area 3

R2(config)#router ospf 1
R2(config-router)#router-id 2.2.2.2 
R2(config-router)#network 20.2.2.2 0.0.0.0 area 0
R2(config-router)#network 123.123.123.0 0.0.0.255 area 0

R3(config)#router ospf 1
R3(config-router)#router-id 3.3.3.3
R3(config-router)#network 123.123.123.0 0.0.0.255 area 0

R4(config)#router ospf 1
R4(config-router)#router-id 4.4.4.4
R4(config-router)#network 123.123.123.0 0.0.0.255 area 0
R4(config-router)#network 14.14.14.0 0.0.0.255 area 1

R5(config)#router ospf 1
R5(config-router)#router-id 5.5.5.5
R5(config-router)#network 123.123.123.0 0.0.0.255 area 0
R5(config-router)#network 56.56.56.0 0.0.0.255 area 2

R6(config)#router ospf 1
R6(config-router)#router-id 6.6.6.6
R6(config-router)#network 56.56.56.0 0.0.0.255 area 2
R6(config-router)#network 60.6.6.6 0.0.0.0 area 2

R7(config)#router ospf 1  
R7(config-router)#router-id 7.7.7.7
R7(config-router)#network 17.17.17.0 0.0.0.255 area 3

在R6上ping R1，显示网络畅通

R6(config-router)#do ping 14.14.14.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 14.14.14.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/52/72 ms

在R6上ping R7

R6#ping 17.17.17.7

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 17.17.17.7, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

查看R6路由表：

R6(config-if)#do sh ip ro


Gateway of last resort is not set

     56.0.0.0/24 is subnetted, 1 subnets
C       56.56.56.0 is directly connected, FastEthernet0/6
     123.0.0.0/24 is subnetted, 1 subnets
O IA    123.123.123.0 [110/2] via 56.56.56.5, 00:01:39, FastEthernet0/6
     14.0.0.0/24 is subnetted, 1 subnets
O IA    14.14.14.0 [110/3] via 56.56.56.5, 00:01:39, FastEthernet0/6
     60.0.0.0/24 is subnetted, 1 subnets
C       60.6.6.0 is directly connected, Loopback0

显然R6学习了所有路由条目，除了17.17.17.0网络，该路由不被学习是因为area 3是孤岛区域，解决办法是做一条虚链路。在ABR（区域边界路由器）上分别：

R1(config-router)#area 1 virtual-link 4.4.4.4

R4(config-router)#area 1 virtual-link 1.1.1.1

R6#ping 17.17.17.7

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 17.17.17.7, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/89/136 ms

至此，全网互通

2.链路认证

R1(config-router)#interface f0/1
R1(config-if)#ip OSPF authentication
R1(config-if)#ip OSPF authentication-key 123456

在R1上配置链路认证后，R1和R4 ospf关系down，网络不再畅通

R4#ping 17.17.17.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 17.17.17.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

在R4上配置明文链路认证：

R4(config-if)#interface f0/1
R4(config-if)#ip ospf authentication
R4(config-if)#ip OSPF authentication-key 123456

（密文配置命令：）

interface <intf-id>

Ip ospf authentication message-digest

Ip ospf message-digest-key <key-id> md5 <key>

链路认证通过后：

R4#ping 17.17.17.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 17.17.17.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/15/28 ms

而孤岛区域不会受影响：

R6#ping 17.17.17.7

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 17.17.17.7, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 44/77/104 ms

3.区域认证

R2(config)#router os 1
R2(config-router)#area 0 authentication 

R2(config-router)#interface f0/2  //在区域内所有接口配置
R2(config-if)#ip ospf authentication-key 123456

R3(config)#router OSPF 1
R3(config-router)#area 0 authentication 
R3(config-router)#interface f0/3
R3(config-if)#ip ospf authentication-key 123456

R4(config)#router OSPF 1
R4(config-router)#area 0 authentication 
R4(config-router)#interface f0/4
R4(config-if)#ip ospf authentication-key 123456

R5(config)#router OSPF 1
R5(config-router)#area 0 authentication 
R5(config-router)#interface f0/5
R5(config-if)#ip ospf authentication-key 123456

（密文配置命令：）

router ospf <pid>
Area <id> authentication message-digest
进入区域内所有接口（除环回口）
Ip ospf message-digest-key <id> md5 <key>

此时，可在启用区域认证的设备上查看区域认证的信息，显然链路认证配置成功。

R3(config-if)#do show ip OSPF
    Area BACKBONE(0)
	Number of interfaces in this area is 1
	Area has simple password authentication
	SPF algorithm last executed 00:00:57.048 ago
	SPF algorithm executed 24 times
	Area ranges are
	Router LSA rebuild timer due in 00:00:30
	Number of LSA 12. Checksum Sum 0x04AEED
	Number of opaque link LSA 0. Checksum Sum 0x000000
	Number of DCbitless LSA 0
	Number of indication LSA 0
	Number of DoNotAge LSA 3
	Flood list length 0

而虚链路受区域认证影响失效

R6#ping 17.17.17.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 17.17.17.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

解决办法：虚链路设备同样参与区域认证

R1(config-router)#area 1 virtual-link 4.4.4.4 authentication message-digest
R1(config-router)#area 1 virtual-link 4.4.4.4 message-digest-key 1 md5 123456

R4(config-router)#area 1 virtual-link 1.1.1.1 authentication message-digest
R4(config-router)#area 1 virtual-link 1.1.1.1 message-digest-key 1 md5 123456

R6#ping 17.17.17.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 17.17.17.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/64/84 ms

4.特殊区域设置

area2不需要学习全局路由，因此将其设置为T-NSSA区域

R5(config)#router OSPF 1
R5(config-router)#area 2 nssa no-summary 

R6(config)#router OSPF 1
R6(config-router)#area 2 nssa

此时R6路由表只有直连路由信息：

R6(config-router)#do show ip route

Gateway of last resort is not set

     56.0.0.0/24 is subnetted, 1 subnets
C       56.56.56.0 is directly connected, FastEthernet0/6
     60.0.0.0/24 is subnetted, 1 subnets
C       60.6.6.0 is directly connected, Loopback0

padovan

关注

0
点赞
踩
5

收藏

觉得还不错? 一键收藏
0
评论
ospf实验配置详解虚链路+链路认证+区域认证+特殊区域设置

步骤1:全网互通 1.1:ip地址配置R1(config)#int f0/1R1(config-if)#ip add 14.14.14.1 255.255.255.0R1(config-if)#no shR1(config)#int lo0R1(config-if)#ip add 1.1.1.1 255.255.255.0R2(config-if)#int f0/2R2(config-if)#ip add 123.123.123.2 2.........
复制链接

扫一扫