ダウンロード |
| ライター翻訳版 - April 5, 2002 |
| 機械翻訳版 - August 15, 2005 |
| 英語版 - August 15, 2005 |
| Document ID: 8313 |
目次
概要
このサンプル構成では、OSPF ネットワークの仮想リンクで平文認証および Message Digest 5（MD5）認証を有効にする方法を示します。OSPF 認証の詳細については、「OSPF での認証のサンプル構成」を参照してください。
ネットワーク ダイアグラム
平文認証の構成
次の構成で、ルータ 3.3.3.3 にはエリア 0 にインターフェイスがありませんが、エリア 0 に仮想接続されています。これにより、ルータ 3.3.3.3 は、仮想エリア境界ルータ（ABR）になります。つまり、ルータ 3.3.3.3 でエリア 0 に対して認証を有効にする必要があります。
| ルータ 1.1.1.1 |
|---|
hostname r1.1.1.1 interface Loopback0 ip address 1.1.1.1 255.0.0.0 interface Ethernet2/0/0 ip address 4.0.0.1 255.0.0.0 ip ospf authentication-key cisco interface Serial2/1/0 ip address 5.0.0.1 255.0.0.0 router ospf 2 network 4.0.0.0 0.255.255.255 area 0 network 5.0.0.0 0.255.255.255 area 1 area 0 authentication area 1 virtual-link 3.3.3.3 authentication-key cisco |
| ルータ 3.3.3.3 |
hostname r3.3.3.3 interface Loopback0 ip address 3.3.3.3 255.0.0.0 interface Ethernet0/0 ip address 12.0.0.3 255.0.0.0 interface ATM2/0.20 point-to-point ip address 6.0.0.3 255.0.0.0 router ospf 2 network 12.0.0.0 0.255.255.255 area 2 network 6.0.0.0 0.255.255.255 area 1 area 0 authentication area 1 virtual-link 1.1.1.1 authentication-key cisco |
コマンドのデバッグと表示
- debug ip ospf adj
- show ip ospf virtual-links
- show ip route
上のデバッグ コマンドを使用する前に、「デバッグ コマンドに関する重要な情報」を参照してください。
サンプル デバッグ出力
r3.3.3.3#debug ip ospf adj 20:17:44: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL1 seq 0x1302 opt 0x22 flag 0x7 len 32 mtu 0 state INIT 20:17:44: OSPF: 2 Way Communication to 1.1.1.1 on OSPF_VL1, state 2WAY 20:17:44: OSPF: Send DBD to 1.1.1.1 on OSPF_VL1 seq 0xC11 opt 0x62 flag 0x7 len 32 20:17:44: OSPF: First DBD and we are not SLAVE 20:17:44: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL1 seq 0xC11 opt 0x22 flag 0x2 len 172 mtu 0 state EXSTART 20:17:44: OSPF: NBR Negotiation Done. We are the MASTER 20:17:44: OSPF: Send DBD to 1.1.1.1 on OSPF_VL1 seq 0xC12 opt 0x62 flag 0x3 len 172 20:17:44: OSPF: Database request to 1.1.1.1 20:17:44: OSPF: sent LS REQ packet to 5.0.0.1, length 12 20:17:44: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL1 seq 0xC12 opt 0x22 flag 0x0 len 32 mtu 0 state EXCHANGE 20:17:44: OSPF: Send DBD to 1.1.1.1 on OSPF_VL1 seq 0xC13 opt 0x62 flag 0x1 len 32 20:17:44: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL1 seq 0xC13 opt 0x22 flag 0x0 len 32 mtu 0 state EXCHANGE 20:17:44: OSPF: Exchange Done with 1.1.1.1 on OSPF_VL1 20:17:44: OSPF: Synchronized with 1.1.1.1 on OSPF_VL1, state FULL 20:17:45: OSPF: Build router LSA for area 0, router ID 3.3.3.3, seq 0x80000031 r3.3.3.3#show ip ospf virtual-links Virtual Link OSPF_VL1 to router 1.1.1.1 is up Run as demand circuit DoNotAge LSA allowed. Transit area 1, via interface Serial0/0, Cost of using 128 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:09 Adjacency State FULL (Hello suppressed) r3.3.3.3#show ip route C 3.0.0.0/8 is directly connected, Loopback0 O 4.0.0.0/8 [110/138] via 6.0.0.2, 00:00:06, Serial0/0 O 5.0.0.0/8 [110/128] via 6.0.0.2, 00:01:25, Serial0/0 C 6.0.0.0/8 is directly connected, Serial0/0 C 12.0.0.0/8 is directly connected, Ethernet1/1
MD5 認証の構成
このシナリオでは、ルータ 3.3.3.3 でエリア 0 に対して認証を有効にして、仮想リンクをアクティブにする必要があります。これを行うには、area 0 authentication message-digest コマンドを使用します。area 1 virtual-link 1.1.1.1 message-digest-key 1 md5 cisco コマンドは認証キーを提供します。
| ルータ 1.1.1.1 |
|---|
hostname r1.1.1.1 interface Loopback0 ip address 1.1.1.1 255.0.0.0 interface Ethernet2/0/0 ip address 4.0.0.1 255.0.0.0 ip ospf message-digest-key 1 md5 cisco interface Serial2/1/0 ip address 5.0.0.1 255.0.0.0 router ospf 2 network 4.0.0.0 0.255.255.255 area 0 network 5.0.0.0 0.255.255.255 area 1 area 0 authentication message-digest area 1 virtual-link 3.3.3.3 message-digest-key 1 md5 cisco |
| ルータ 3.3.3.3 |
hostname r3.3.3.3 interface Loopback0 ip address 3.3.3.3 255.0.0.0 interface Ethernet0/0 ip address 12.0.0.3 255.0.0.0 interface ATM2/0.20 point-to-point ip address 6.0.0.3 255.0.0.0 router ospf 2 network 12.0.0.0 0.255.255.255 area 2 network 6.0.0.0 0.255.255.255 area 1 area 0 authentication message-digest area 1 virtual-link 1.1.1.1 message-digest-key 1 md5 cisco |
コマンドのデバッグと表示
- debug ip ospf adj
- show ip ospf virtual-links
- show ip route
上のデバッグ コマンドを使用する前に、「デバッグ コマンドに関する重要な情報」を参照してください。
サンプル デバッグ出力
r3.3.3.3#debug ip ospf adj 03:17:31: OSPF: Rcv hello from 1.1.1.1 area 0 from OSPF_VL2 5.0.0.1 03:17:31: OSPF: Interface OSPF_VL2 going Up 03:17:31: OSPF: Send with youngest Key 1 03:17:31: OSPF: Build router LSA for area 0, router ID 3.3.3.3, seq 0x8000000E 03:17:31: OSPF: Build router LSA for area 1, router ID 3.3.3.3, seq 0x8000001A 03:17:31: OSPF: Build router LSA for area 2, router ID 3.3.3.3, seq 0x8000000C 03:17:34: OSPF: Send with youngest Key 1 03:17:40: OSPF: Rcv hello from 1.1.1.1 area 0 from OSPF_VL2 5.0.0.1 03:17:40: OSPF: 2 Way Communication to 1.1.1.1 on OSPF_VL2, state 2WAY 03:17:40: OSPF: Send DBD to 1.1.1.1 on OSPF_VL2 seq 0xC2A opt 0x22 flag 0x7 len2 03:17:40: OSPF: Send with youngest Key 1 03:17:40: OSPF: End of hello processing 03:17:40: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL2 seq 0x234 opt 0x22 flag 0x7 leT 03:17:40: OSPF: First DBD and we are not SLAVE 03:17:40: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL2 seq 0xC2A opt 0x22 flag 0x2 leT 03:17:40: OSPF: NBR Negotiation Done. We are the MASTER 03:17:40: OSPF: Send DBD to 1.1.1.1 on OSPF_VL2 seq 0xC2B opt 0x22 flag 0x3 len2 03:17:40: OSPF: Send with youngest Key 1 03:17:40: OSPF: Send with youngest Key 1 03:17:40: OSPF: Database request to 1.1.1.1 03:17:40: OSPF: sent LS REQ packet to 5.0.0.1, length 12 03:17:40: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL2 seq 0xC2B opt 0x22 flag 0x0 leE 03:17:40: OSPF: Send DBD to 1.1.1.1 on OSPF_VL2 seq 0xC2C opt 0x22 flag 0x1 len2 03:17:40: OSPF: Send with youngest Key 1 03:17:40: OSPF: Send with youngest Key 1 03:17:40: OSPF: Rcv DBD from 1.1.1.1 on OSPF_VL2 seq 0xC2C opt 0x22 flag 0x0 leE 03:17:40: OSPF: Exchange Done with 1.1.1.1 on OSPF_VL2 03:17:40: OSPF: Synchronized with 1.1.1.1 on OSPF_VL2, state FULL 03:17:41: OSPF: Build router LSA for area 0, router ID 3.3.3.3, seq 0x8000000F r3.3.3.3#show ip ospf virtual-links Virtual Link OSPF_VL2 to router 1.1.1.1 is up Run as demand circuit DoNotAge LSA allowed. Transit area 1, via interface Serial0/0, Cost of using 128 Transmit Delay is 1 sec, State POINT_TO_POINT, Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:04 Adjacency State FULL (Hello suppressed) Message digest authentication enabled Youngest key id is 1 r3.3.3.3#show ip route C 3.0.0.0/8 is directly connected, Loopback0 O 4.0.0.0/8 [110/138] via 6.0.0.2, 00:00:06, Serial0/0 O 5.0.0.0/8 [110/128] via 6.0.0.2, 00:01:25, Serial0/0 C 6.0.0.0/8 is directly connected, Serial0/0 C 12.0.0.0/8 is directly connected, Ethernet1/1