RSVP Message Authentication
First Published: March 17, 2003
Last Updated: August 6, 2007
The Resource Reservation Protocol (RSVP) Message Authentication feature provides a secure method to control quality of service (QoS) access to a network.
History for the RSVP Message Authentication Feature
|
|
12.2(15)T |
This feature was introduced. |
12.0(26)S |
Restrictions were added for interfaces that use Fast Reroute (FRR) node or link protection and for RSVP hellos for FRR for packet over SONET (POS) interfaces. |
12.0(29)S |
Support was added for per-neighbor keys. |
12.2(33)SRA |
This feature was integrated into Cisco IOS Release 12.2(33)SRA. |
12.2(33)SXH |
This feature was integrated into Cisco IOS Release 12.2(33)SXH. |
Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•Prerequisites for RSVP Message Authentication
•Restrictions for RSVP Message Authentication
•Information About RSVP Message Authentication
•How to Configure RSVP Message Authentication
•Configuration Examples for RSVP Message Authentication
•Additional References
•Command Reference
Prerequisites for RSVP Message Authentication
Ensure that RSVP is configured on one or more interfaces on at least two neighboring routers that share a link within the network.
Restrictions for RSVP Message Authentication
•The RSVP Message Authentication feature is only for authenticating RSVP neighbors.
•The RSVP Message Authentication feature cannot discriminate between various QoS applications or users, of which many may exist on an authenticated RSVP neighbor.
•Different send and accept lifetimes for the same key in a specific key chain are not supported; all RSVP key types are bidirectional.
•Authentication for graceful restart hello messages is supported for per-neighbor and per-access control list (ACL) keys, but not for per-interface keys.
•You cannot use the ip rsvp authentication key and the ip rsvp authentication key-chain commands on the same router interface.
•For a Multiprotocol Label Switching/Traffic Engineering (MPLS/TE) configuration, use per-neighbor keys with physical addresses and router IDs.
Information About RSVP Message Authentication
To configure RSVP Message Authentication, you need to understand the following concepts:
•Feature Design of RSVP Message Authentication
•Global Authentication and Parameter Inheritance
•Per-Neighbor Keys
•Key Chains
•Benefits of RSVP Message Authentication
Feature Design of RSVP Message Authentication
Network administrators need the ability to establish a security domain to control the set of systems that initiate RSVP requests.
The RSVP Message Authentication feature permits neighbors in an RSVP network to use a secure hash to sign all RSVP signaling messages digitally, thus allowing the receiver of an RSVP message to verify the sender of the message without relying solely on the sender's IP address as is done by issuing the ip rsvp neighbor command with an ACL.
The signature is accomplished on a per-RSVP-hop basis with an RSVP integrity object in the RSVP message as defined in RFC 2747. This method provides protection against forgery or message modification. However, the receiver must know the security key used by the sender in order to validate the digital signature in the received RSVP message.
Network administrators manually configure a common key for each RSVP neighbor interface on the shared network. A sample configuration is shown in Figure 1.
Figure 1 RSVP Message Authentication Configuration
Global Authentication and Parameter Inheritance
You can configure global defaults for all authentication parameters including key, type, window size, lifetime, and challenge. These defaults are inherited when you enable authentication for each neighbor or interface. However, you can also configure these parameters individually on a per-neighbor or per-interface basis in which case the inherited global defaults are ignored.
Using global authentication and parameter inheritance can simplify configuration because you can enable or disable authentication without having to change each per-neighbor or per-interface attribute. You can activate authentication for all neighbors by using two commands, one to define a global default key and one to enable authentication globally. However, using the same key for all neighbors does not provide the best network security.
Note RSVP uses the following rules when choosing which authentication parameter to use when that parameter is configured at multiple levels (per-interface, per-neighbor, or global). RSVP goes from the most specific to the least specific; that is, per-neighbor, per-interface, and then global. The rules are slightly different when searching the configuration for the right key to authenticate an RSVP message— per-neighbor, per-ACL, per-interface, and then global.
Per-Neighbor Keys
In Figure 2, to enable authentication between Internet service provider (ISP) Routers A and B, A and C, and A and D, the ISPs must share a common key. However, sharing a common key also enables authentication between ISP Routers B and C, C and D, and B and D. You may not want authentication among all the ISPs because they might be different companies with unique security domains Figure 2.
Figure 2 RSVP Message Authentication in an Ethernet Configuration
On ISP Router A, you create a different key for ISP Routers B, C, and D and assign them to their respective IP addresses using RSVP commands. On the other routers, create a key to communicate with ISP Router A's IP address.
Key Chains
For each RSVP neighbor, you can configure a list of keys with specific IDs that are unique and have different lifetimes so that keys can be changed at predetermined intervals automatically without any disruption of service. Automatic key rotation enhances network security by minimizing the problems that could result if an untrusted source obtained, deduced, or guessed the current key.
Note If you use overlapping time windows for your key lifetimes, RSVP asks the Cisco IOS software key manager component for the next live key starting at time T. The key manager walks the keys in the chain until it finds the first one with start time S and end time E such that S <= T <= E. Therefore, the key with the smallest value (E-T) may not be used next.
Benefits of RSVP Message Authentication
Improved Security
The RSVP Message Authentication feature greatly reduces the chance of an RSVP-based spoofing attack and provides a secure method to control QoS access to a network.
Multiple Environments
The RSVP Message Authentication feature can be used in traffic engineering (TE) and non-TE environments as well as with the subnetwork bandwidth manager (SBM).
Multiple Platforms and Interfaces
The RSVP Message Authentication feature can be used on any supported RSVP platform or interface.
How to Configure RSVP Message Authentication
The following configuration parameters instruct RSVP on how to generate and verify integrity objects in various RSVP messages.
Note There are two configuration procedures: full and minimal. There are also two types of authentication procedures: interface and neighbor.
Per-Interface Authentication—Full Configuration
Perform the following procedures for a full configuration for per-interface authentication:
•Enabling RSVP on an Interface (required)
•Configuring an RSVP Authentication Type (optional)
•Configuring an RSVP Authentication Key (required)
•Enabling RSVP Key Encryption (optional)
•Enabling RSVP Authentication Challenge (optional)
•Configuring RSVP Authentication Lifetime (optional)
•Configuring RSVP Authentication Window Size (optional)
•Activating RSVP Authentication (required)
•Verifying RSVP Message Authentication (optional)
Per-Interface Authentication—Minimal Configuration
Perform the following tasks for a minimal configuration for per-interface authentication:
•Enabling RSVP on an Interface (required)
•Configuring an RSVP Authentication Key (required)
•Activating RSVP Authentication (required)
Per-Neighbor Authentication—Full Configuration
Perform the following procedures for a full configuration for per-neighbor authentication:
•Configuring an RSVP Authentication Type (optional)
•Enabling RSVP Authentication Challenge (optional)
•Enabling RSVP Key Encryption (optional)
•Configuring RSVP Authentication Lifetime (optional)
•Configuring RSVP Authentication Window Size (optional)
•Activating RSVP Authentication (required)
•Verifying RSVP Message Authentication (optional)
•Configuring a Key Chain (required)
•Binding a Key Chain to an RSVP Neighbor (required)
Per-Neighbor Authentication—Minimal Configuration
Perform the following tasks for a minimal configuration for per-neighbor authentication:
•Activating RSVP Authentication (required)
•Configuring a Key Chain (required)
•Binding a Key Chain to an RSVP Neighbor (required)
Enabling RSVP on an Interface
Perform this task to enable RSVP on an interface.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface type number
4. ip rsvp bandwidth [interface-kbps [single-flow-kbps]]
5. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
interface type number
Router(config)# interface Ethernet0/0 |
Enters interface configuration mode. •The type number argument identifies the interface to be configured. |
Step 4 |
ip rsvp bandwidth [interface-kbps [single-flow-kbps]]
Router(config-if)# ip rsvp bandwidth 7500 7500 |
Enables RSVP on an interface. •The optional interface-kbps and single-flow-kbps arguments specify the amount of bandwidth that can be allocated by RSVP flows or to a single flow, respectively. Values are from 1 to 10,000,000. Note Repeat this command for each interface that you want to enable. |
Step 5 |
end
Router(config-if)# end |
Returns to privileged EXEC mode. |
Configuring an RSVP Authentication Type
Perform this task to configure an RSVP authentication type.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface type number
4. ip rsvp authentication type {md5 | sha-1}
5. end
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
interface type number
Router(config)# interface Ethernet0/0 |
Enters interface configuration mode. •The type number argument identifies the interface to be configured. Note Omit this step if you are configuring an authentication type for a neighbor or setting a global default. |
Step 4 |
ip rsvp authentication type {md5 | sha-1}
For interface authentication: Router(config-if)# ip rsvp authentication type sha-1
For neighbor authentication: Router(config)# ip rsvp authentication neighbor address 10.1.1.1 type sha-1 or Router(config)# ip rsvp authentication neighbor access-list 1 type sha-1
For a global default: Router(config)# ip rsvp authentication type sha-1 |
Specifies the algorithm used to generate cryptographic signatures in RSVP messages on an interface or globally. •The algorithms are md5, the default, and sha-1, which is newer and more secure than md5. Note Omit the neighbor address address or the neighbor access-list acl-name or acl-number to set the global default. |
Step 5 |
end
Router(config-if)# end |
Returns to privileged EXEC mode. |
Configuring an RSVP Authentication Key
Perform this task to configure an RSVP authentication key.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface type number
4. ip rsvp authentication key passphrase
5. exit
6. ip rsvp authentication key-chain chain
7. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. Note If you want to configure a key, proceed to Step 3; if you want to configure a key chain, proceed to Step 6. |
Step 3 |
interface type number
Router(config)# interface Ethernet0/0 |
Enters interface configuration mode. •The type number argument identifies the interface to be configured. Note Omit this step and go to Step 6 if you want to configure only a key chain. |
Step 4 |
ip rsvp authentication key passphrase
Router(config-if)# ip rsvp authentication key 11223344
|
Specifies the data string (key) for the authentication algorithm. •The key consists of 8 to 40 characters. It can include spaces and multiple words. It can also be encrypted or appear in clear text when displayed. Note Omit this step if you want to configure a key chain. |
Step 5 |
exit
Router(config-if)# exit |
Exits to global configuration mode. |
Step 6 |
ip rsvp authentication key-chain chain
For neighbor authentication: Router(config)# ip rsvp authentication neighbor address 10.1.1.1 key-chain xzy or Router(config)# ip rsvp authentication neighbor access-list 1 key-chain xzy
For a global default: Router(config)# ip rsvp authentication key-chain xzy |
Specifies the data string (key chain) for the authentication algorithm. •The key chain must have at least one key, but can have up to 2,147,483647 keys. Note You cannot use the ip rsvp authentication key and the ip rsvp authentication key-chain commands on the same router interface. The commands supersede each other; however, no error message is generated. Note Omit the neighbor address address or the neighbor access-list acl-name or acl-number to set the global default. |
Step 7 |
end
Router(config)# end |
Returns to privileged EXEC mode. |
Enabling RSVP Key Encryption
Perform this task to enable RSVP key encryption when the key is stored in the router configuration. (This prevents anyone from seeing the clear text key in the configuration file.)
SUMMARY STEPS
1. enable
2. configure terminal
3. key config-key 1 string
4. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
key config-key 1 string
Router(config)# key config-key 1 11223344 |
Enables key encryption in the configuration file. Note The string argument can contain up to eight alphanumeric characters. |
Step 4 |
end
Router(config)# end |
Returns to privileged EXEC mode. |
Enabling RSVP Authentication Challenge
Perform this task to enable RSVP authentication challenge.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface type number
4. ip rsvp authentication challenge
5. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
interface type number
Router(config)# interface Ethernet0/0 |
Enters interface configuration mode. •The type number argument identifies the interface to be configured. Note Omit this step if you are configuring an authentication challenge for a neighbor or setting a global default. |
Step 4 |
ip rsvp authentication challenge
For interface authentication: Router(config-if)# ip rsvp authentication challenge
For neighbor authentication: Router(config)# ip rsvp authentication neighbor address 10.1.1.1 challenge or Router(config)# ip rsvp authentication neighbor access-list 1 challenge
For a global default: Router(config)# ip rsvp authentication challenge |
Makes RSVP perform a challenge-response handshake on an interface or globally when RSVP learns about any new challenge-capable neighbors on a network. Note Omit the neighbor address address or the neighbor access-list acl-name or acl-number to set the global default. |
Step 5 |
end
Router(config-if)# end |
Returns to privileged EXEC mode. |
Configuring RSVP Authentication Lifetime
Perform this task to configure the lifetimes of security associations between RSVP neighbors.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface type number
4. ip rsvp authentication lifetime hh:mm:ss
5. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
interface type number
Router(config)# interface Ethernet0/0 Note Omit this step if you are configuring an authentication lifetime for a neighbor or setting a global default. |
Enters interface configuration mode. •The type number argument identifies the interface to be configured. |
Step 4 |
ip rsvp authentication lifetime hh:mm:ss
For interface authentication: Router(config-if)# ip rsvp authentication lifetime 00:05:00
For neighbor authentication: Router(config)# ip rsvp authentication neighbor address 10.1.1.1 lifetime 00:05:00 or Router(config)# ip rsvp authentication neighbor access-list 1 lifetime 00:05:00
For a global default: Router(config)# ip rsvp authentication 00:05:00 |
Controls how long RSVP maintains security associations with RSVP neighbors on an interface or globally. •The default security association for hh:mm:ss is 30 minutes; the range is 1 second to 24 hours. Note Omit the neighbor address address or the neighbor access-list acl-name or acl-number to set the global default. |
Step 5 |
end
Router(config-if)# end |
Returns to privileged EXEC mode. |
Configuring RSVP Authentication Window Size
Perform this task to configure the RSVP authentication window size.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface type number
4. ip rsvp authentication window-size n
5. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
interface type number
Router(config)# interface Ethernet0/0 |
Enters interface configuration mode. •The type number argument identifies the interface to be configured. Note Omit this step if you are configuring a window size for a neighbor or setting a global default. |
Step 4 |
ip rsvp authentication window-size n
For interface authentication: Router(config-if)# ip rsvp authentication window-size 2
For neighbor authentication: Router(config)# ip rsvp authentication neighbor address 10.1.1.1 window-size 2 or Router(config)# ip rsvp authentication neighbor access-list 1 window-size
For a global default: Router(config)# ip rsvp authentication window-size 2 |
Specifies the maximum number of authenticated messages that can be received out of order on an interface or globally. •The default value is one message; the range is 1 to 64 messages. Note Omit the neighbor address address or the neighbor access-list acl-name or acl-number to set the global default. |
Step 5 |
end
Router(config-if)# end |
Returns to privileged EXEC mode. |
Activating RSVP Authentication
Perform this task to activate RSVP authentication.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface type number
4. ip rsvp authentication
5. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
interface type number
Router(config)# interface Ethernet0/0 |
Enters interface configuration mode. •The type number argument identifies the interface to be configured. Note Omit this step if you are configuring authentication for a neighbor or setting a global default. |
Step 4 |
ip rsvp authentication
For interface authentication: Router(config-if)# ip rsvp authentication For neighbor authentication: Router(config)# ip rsvp authentication neighbor address 10.1.1.1 or Router(config)# ip rsvp authentication neighbor access-list 1
For a global default: Router(config)# ip rsvp authentication |
Activates RSVP cryptographic authentication on an interface or globally. Note Omit the neighbor address address or the neighbor access-list acl-name or acl-number to set the global default. |
Step 5 |
end
Router(config-if)# end |
Returns to privileged EXEC mode. |
Verifying RSVP Message Authentication
Perform this task to verify that the RSVP Message Authentication feature is functioning.
SUMMARY STEPS
1. enable
2. show ip rsvp interface [detail] [interface-type interface-number]
3. show ip rsvp authentication [detail] [from {ip-address | hostname}] [to {ip-address | hostname}]
4. show ip rsvp counters [authentication | interface interface-unit | neighbor | summary]
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
show ip rsvp interface [detail] [interface-type interface-number]
Router# show ip rsvp interface detail |
Displays information about interfaces on which RSVP is enabled, including the current allocation budget and maximum available bandwidth. •The optional detail keyword displays the bandwidth, signaling, and authentication parameters. |
Step 3 |
show ip rsvp authentication [detail] [from {ip-address | hostname}] [to {ip-address | hostname}]
Router# show ip rsvp authentication detail |
Displays the security associations that RSVP has established with other RSVP neighbors. •The optional detail keyword displays state information that includes IP addresses, interfaces enabled, and configured cryptographic authentication parameters about security associations that RSVP has established with neighbors. |
Step 4 |
show ip rsvp counters [authentication | interface interface-unit | neighbor | summary]
Router# show ip rsvp counters summary
Router# show ip rsvp counters
authentication
|
Displays all RSVP counters. Note The errors counter increments whenever an authentication error occurs, but can also increment for errors not related to authentication. •The optional authentication keyword shows a list of RSVP authentication counters. •The optional interface interface-unit keyword argument combination shows the number of RSVP messages sent and received by the specific interface. •The optional neighbor keyword shows the number of RSVP messages sent and received by the specific neighbor. •The optional summary keyword shows the cumulative number of RSVP messages sent and received by the router. It does not print per-interface counters. |
Configuring a Key Chain
Perform this task to configure a key chain for neighbor authentication.
SUMMARY STEPS
1. enable
2. configure terminal
3. key chain name-of-chain
4. {key [key-ID] | key-string [text] | accept-lifetime [start-time {infinite | end-time | duration seconds}] | send-lifetime [start-time {infinite | end-time | duration seconds}]}
5. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
key chain name-of-chain
Router(config)# key chain neighbor_V |
Enters key-chain mode. |
Step 4 |
{key [key-ID] | key-string [text] | accept-lifetime [start-time {infinite | end-time | duration seconds}] | send-lifetime [start-time {infinite | end-time | duration seconds}]
Router(config-keychain)# key 1
Router(config-keychain)# key-string ABcXyz |
Selects the parameters for the key chain. (These are submodes.) Note For details on these parameters, see the Cisco IOS IP Command Reference, Volume 2 of 4, Routing Protocols, Release 12.3T. Note accept-lifetime is ignored when a key chain is assigned to RSVP. |
Step 5 |
end
Router(config-keychain)# end |
Returns to privileged EXEC mode. |
Binding a Key Chain to an RSVP Neighbor
Perform this task to bind a key chain to an RSVP neighbor for neighbor authentication.
SUMMARY STEPS
1. enable
2. configure terminal
3. ip rsvp authentication neighbor address address key-chain key-chain-name
or
ip rsvp authentication neighbor access-list acl-name or acl-number key-chain key-chain-name
4. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
ip rsvp authentication neighbor address address key-chain key-chain-name or ip rsvp authentication neighbor access-list acl-name or acl-number key-chain key-chain-name
Router(config)# ip rsvp authentication neighbor access-list 1 key-chain neighbor_V |
Binds a key chain to an IP address or to an ACL and enters key-chain mode. Note If you are using an ACL, you must create it before you bind it to a key chain. See the ip rsvp authentication command in the Command Reference section for examples. |
Step 4 |
end
Router(config-keychain)# end |
Returns to privileged EXEC mode. |
Troubleshooting Tips
After you enable RSVP authentication, RSVP logs system error events whenever an authentication check fails. These events are logged instead of just being displayed when debugging is enabled because they may indicate potential security attacks. The events are generated when:
•RSVP receives a message that does not contain the correct cryptographic signature. This could be due to misconfiguration of the authentication key or algorithm on one or more RSVP neighbors, but it may also indicate an (unsuccessful) attack.
•RSVP receives a message with the correct cryptographic signature, but with a duplicate authentication sequence number. This may indicate an (unsuccessful) message replay attack.
•RSVP receives a message with the correct cryptographic signature, but with an authentication sequence number that is outside the receive window. This could be due to a reordered burst of valid RSVP messages, but it may also indicate an (unsuccessful) message replay attack.
•Failed challenges result from timeouts or bad challenge responses.
To troubleshoot the RSVP Message Authentication feature, use the following commands in privileged EXEC mode.
|
|
Router# debug ip rsvp authentication
|
Displays output related to RSVP authentication. |
Router# debug ip rsvp dump signalling |
Displays brief information about signaling (Path and Resv) messages. |
Router# debug ip rsvp errors |
Displays error events including authentication errors. |
Configuration Examples for RSVP Message Authentication
•Example: RSVP Message Authentication Per-Interface
•Example: RSVP Message Authentication Per-Neighbor
Example: RSVP Message Authentication Per-Interface
In the following example, the cryptographic authentication parameters, including type, key, challenge, lifetime, and window size are configured; and authentication is activated:
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# interface e0/0
Router(config-if)# ip rsvp bandwidth 7500 7500
Router(config-if)# ip rsvp authentication type sha-1
Router(config-if)# ip rsvp authentication key 11223344
Router(config-if)# ip rsvp authentication challenge
Router(config-if)# ip rsvp authentication lifetime 00:30:05
Router(config-if)# ip rsvp authentication window-size 2
Router(config-if)# ip rsvp authentication
In the following output from the show ip rsvp interface detail command, notice the cryptographic authentication parameters that you configured for the Ethernet0/0 interface:
Router# show ip rsvp interface detail
Curr allocated: 0 bits/sec
Max. allowed (total): 7500K bits/sec
Max. allowed (per flow): 7500K bits/sec
Max. allowed for LSP tunnels using sub-pools: 0 bits/sec
Set aside by policy (total): 0 bits/sec
Using IP encap: 0. Using UDP encap: 0
Refresh reduction: disabled
In the preceding example, the authentication key appears in clear text. If you enter the key-config-key 1 string command, the key appears encrypted, as in the following example:
Router# show ip rsvp interface detail
Curr allocated: 0 bits/sec
Max. allowed (total): 7500K bits/sec
Max. allowed (per flow): 7500K bits/sec
Max. allowed for LSP tunnels using sub-pools: 0 bits/sec
Set aside by policy (total): 0 bits/sec
Using IP encap: 0. Using UDP encap: 0
Refresh reduction: disabled
In the following output, notice that the authentication key changes from encrypted to clear text after the no key config-key 1 command is issued:
Router# show running-config interface e0/0
Building configuration...
Current configuration :247 bytes
ip address 192.168.101.2 255.255.255.0
ip rsvp bandwidth 7500 7500
ip rsvp authentication key 7>70>9:7<872>?74
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# no key config-key 1
Router# show running-config
*Jan 30 08:02:09.559:%SYS-5-CONFIG_I:Configured from console by console
Building configuration...
Current configuration :239 bytes
ip address 192.168.101.2 255.255.255.0
ip rsvp bandwidth 7500 7500
ip rsvp authentication key 11223344
Example: RSVP Message Authentication Per-Neighbor
In the following example, a key chain with two keys for each neighbor is defined, then an access list and a key chain are created for neighbors V, Y, and Z and authentication is explicitly enabled for each neighbor and globally. However, only the neighbors specified will have their messages accepted; messages from other sources will be rejected. This enhances network security.
For security reasons, you should change keys on a regular basis. When the first key expires, the second key automatically takes over. At that point, you should change the first key's key-string to a new value and then set the send lifetimes to take over after the second key expires. The router will log an event when a key expires to remind you to update it.
The lifetimes of the first and second keys for each neighbor overlap. This allows for any clock synchronization problems that might cause the neighbors not to switch keys at the right time. You can avoid these overlaps by configuring the neighbors to use Network Time Protocol (NTP) to synchronize their clocks to a time server.
For an MPLS/TE configuration, physical addresses and router IDs are given.
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# key chain neighbor_V
Router(config-keychain)# key 1
Router(config-keychain-key)# key-string R72*UiAXy
Router(config-keychain-key)# send-life 02:00:00 1 jun 2003 02:00:00 1 aug 2003
Router(config-keychain-key)# exit
Router(config-keychain)# key 2
Router(config-keychain-key)# key-string Pl349&DaQ
Router(config-keychain-key)# send-life 01:00:00 1 jun 2003 02:00:00 1 aug 2003
Router(config-keychain-key)# exit
Router(config-keychain)# exit
Router(config)# key chain neighbor_Y
Router(config-keychain)# key 3
Router(config-keychain-key)# key-string *ZXFwR!03
Router(config-keychain-key)# send-life 02:00:00 1 jun 2003 02:00:00 1 aug 2003
Router(config-keychain-key)# exit
Router(config-keychain)# key 4
Router(config-keychain-key)# key-string UnGR8f&lOmY
Router(config-keychain-key)# send-life 01:00:00 1 jun 2003 02:00:00 1 aug 2003
Router(config-keychain-key)# exit
Router(config-keychain)# exit
Router(config)# key chain neighbor_Z
Router(config-keychain)# key 5
Router(config-keychain-key)# key-string P+T=77&/M
Router(config-keychain-key)# send-life 02:00:00 1 jun 2003 02:00:00 1 aug 2003
Router(config-keychain-key)# exit
Router(config-keychain)# key 6
Router(config-keychain-key)# key-string payattention2me
Router(config-keychain-key)# send-life 01:00:00 1 jun 2003 02:00:00 1 aug 2003
Router(config-keychain-key)# exit
Router(config-keychain)# exit
Note You can use the key-config-key 1 string command to encrypt key chains for an interface, a neighbor, or globally.
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# ip access-list standard neighbor_V
Router(config-std-nacl)# permit 10.0.0.1 <------- physical address
Router(config-std-nacl)# permit 10.0.0.2 <------- physical address
Router(config-std-nacl)# permit 10.0.0.3 <------- router ID
Router(config-std-nacl)# exit
Router(config)# ip access-list standard neighbor_Y
Router(config-std-nacl)# permit 10.0.0.4 <------- physical address
Router(config-std-nacl)# permit 10.0.0.5 <------- physical address
Router(config-std-nacl)# permit 10.0.0.6 <------- router ID
Router(config-std-nacl)# exit
Router(config)# ip access-list standard neighbor_Z
Router(config-std-nacl)# permit 10.0.0.7 <------- physical address
Router(config-std-nacl)# permit 10.0.0.8 <------- physical address
Router(config-std-nacl)# permit 10.0.0.9 <------- router ID
Router(config-std-nacl)# exit
Router(config)# ip rsvp authentication neighbor access-list neighbor_V key-chain
neighbor_V
Router(config)# ip rsvp authentication neighbor access-list neighbor_Y key-chain
neighbor_Y
Router(config)# ip rsvp authentication neighbor access-list neighbor_Z key-chain
neighbor_Z
Router(config)# ip rsvp authentication
Additional References
The following sections provide references related to the RSVP Message Authentication feature.
Related Documents
Standards
|
|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. |
— |
MIBs
|
|
No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature. |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs |
RFCs
|
|
RFC 1321 |
The MD5 Message Digest Algorithm |
RFC 2104 |
HMAC: Keyed-Hashing for Messaging Authentication |
RFC 2205 |
Resource Reservation Protocol |
RFC 2209 |
RSVP—Version 1 Message Processing Rules |
RFC 2401 |
Security Architecture for the Internet Protocol |
RFC 2747 |
RSVP Cryptographic Authentication |
RFC 3097 |
RSVP Crytographic Authentication—Updated Message Type Value |
RFC 3174 |
US Secure Hash Algorithm 1 (SHA1) |
Technical Assistance
|
|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
http://www.cisco.com/cisco/web/support/index.html |
Command Reference
The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the Cisco IOS Quality of Service Solutions Command Reference at http://www.cisco.com/en/US/docs/ios/qos/command/reference/qos_book.html. For information about all Cisco IOS commands, use the Command Lookup Tool at http://tools.cisco.com/Support/CLILookup or a Cisco IOS master commands list.
•clear ip rsvp authentication
•debug ip rsvp authentication
•ip rsvp authentication
•ip rsvp authentication challenge
•ip rsvp authentication key
•ip rsvp authentication key-chain
•ip rsvp authentication lifetime
•ip rsvp authentication neighbor
•ip rsvp authentication type
•ip rsvp authentication window-size
•show ip rsvp authentication
•show ip rsvp counters
•show ip rsvp interface
Glossary
bandwidth—The difference between the highest and lowest frequencies available for network signals. The term also is used to describe the rated throughput capacity of a given network medium or protocol.
DMZ—demilitarized zone. The neutral zone between public and corporate networks.
flow—A stream of data traveling between two endpoints across a network (for example, from one LAN station to another). Multiple flows can be transmitted on a single circuit.
key—A data string that is combined with source data according to an algorithm to produce output that is unreadable until decrypted.
QoS—quality of service. A measure of performance for a transmission system that reflects its transmission quality and service availability.
router—A network layer device that uses one or more metrics to determine the optimal path along which network traffic should be forwarded. Routers forward packets from one network to another based on network layer information.
RSVP—Resource Reservation Protocol. A protocol that supports the reservation of resources across an IP network. Applications running on IP end systems can use RSVP to indicate to other nodes the nature (bandwidth, jitter, maximum burst, and so on) of the packet streams they want to receive.
security association—A block of memory used to hold all the information RSVP needs to authenticate RSVP signaling messages from a specific RSVP neighbor.
spoofing—The act of a packet illegally claiming to be from an address from which it was not actually sent. Spoofing is designed to foil network security mechanisms, such as filters and access lists.
TE—traffic engineering. The techniques and processes used to cause routed traffic to travel through the network on a path other than the one that would have been chosen if standard routing methods had been used.
trusted neighbor—A router with authorized access to information.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2007 Cisco Systems, Inc. All rights reserved.