用手工认证防止RIP的物理入侵

FengYun️

已于 2022-06-13 21:05:05 修改

阅读量100

点赞数

分类专栏： rip 文章标签：网络

于 2022-06-13 21:00:40 首次发布

本文链接：https://blog.csdn.net/qq_53332962/article/details/125267052

版权

rip 专栏收录该内容

3 篇文章 0 订阅

订阅专栏

实验拓扑：

假设R2是物理入侵者，在R2接入网络环境时，就可以获取到网络的拓扑结构，但这并不会影响pc1和pc2之间的通信

PC2>ping 192.168.10.254

Ping 192.168.10.254: 32 data bytes, Press Ctrl_C to break
From 192.168.10.254: bytes=32 seq=1 ttl=126 time=47 ms
From 192.168.10.254: bytes=32 seq=2 ttl=126 time=47 ms
From 192.168.10.254: bytes=32 seq=3 ttl=126 time=31 ms
From 192.168.10.254: bytes=32 seq=4 ttl=126 time=47 ms
From 192.168.10.254: bytes=32 seq=5 ttl=126 time=47 ms

--- 192.168.10.254 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 31/43/47 ms

但如果R2配置了两个环回口，192.168.10.0和192.168.20.0，那么就会造成 pc1和pc2无法正常通信

PC>ping 192.168.10.254

Ping 192.168.10.254: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!
Request timeout!
Request timeout!
Request timeout!

--- 192.168.10.254 ping statistics ---
  5 packet(s) transmitted
  0 packet(s) received
  100.00% packet loss

这是因为发生了负载均衡，我们可以查看R3的路由表

<r3>display ip routing-table 
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
         Destinations : 11       Routes : 12       

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

      10.0.12.0/24  Direct  0    0           D   10.0.12.3       GigabitEthernet
0/0/1
      10.0.12.3/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
0/0/1
    10.0.12.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
0/0/1
      127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0
      127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0
127.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0
   192.168.10.0/24  RIP     100  1           D   10.0.12.1       GigabitEthernet
0/0/1
                    RIP     100  1           D   10.0.12.2       GigabitEthernet
0/0/1
   192.168.20.0/24  Direct  0    0           D   192.168.20.3    GigabitEthernet
0/0/0
   192.168.20.3/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
0/0/0
 192.168.20.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
0/0/0
255.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0

这样就会导致，R2窃取了pc2到pc1的流量

那么如何防止这种现象呢？

我们可以在R1和R3的0/0/1端口上做手工认证

[r1-GigabitEthernet0/0/1]rip authentication-mode md5 usual 818818

[r3-GigabitEthernet0/0/1]rip authentication-mode md5 usual 818818

这样就可以ping通了，不过要等待路由器收敛完成后才可以

PC>ping 192.168.10.254

Ping 192.168.10.254: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 192.168.10.254: bytes=32 seq=2 ttl=126 time=47 ms
From 192.168.10.254: bytes=32 seq=3 ttl=126 time=31 ms
From 192.168.10.254: bytes=32 seq=4 ttl=126 time=47 ms
From 192.168.10.254: bytes=32 seq=5 ttl=126 time=47 ms

--- 192.168.10.254 ping statistics ---
  5 packet(s) transmitted
  4 packet(s) received
  20.00% packet loss
  round-trip min/avg/max = 0/43/47 ms

实验结束