You want to authenticate your RIP traffic to ensure that unauthorized equipment cannot affect how traffic is routed through your network.
The following set of commands enables plain-text RIP authentication:
Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#key chain ORA Router1(config-keychain)#key 1 Router1(config-keychain-key)#key-string oreilly Router1(config-keychain-key)#exit Router1(config-keychain)#exit Router1(config)#interface FastEthernet0/0.1 Router1(config-subif)#ip rip authentication key-chain ORA Router1(config-subif)#ip rip authentication mode text Router1(config-subif)#end Router1#
For greater security, Cisco routers can also use MD5-based authentication:
Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#key chain ORA Router1(config-keychain)#key 1 Router1(config-keychain-key)#key-string oreilly Router1(config-keychain-key)#exit Router1(config-keychain)#exit Router1(config)#interface FastEthernet0/0.1 Router1(config-subif)#ip rip authentication key-chain ORA Router1(config-subif)#ip rip authentication mode md5 Router1(config-subif)#end Router1#
RIP authentication is one of the protocol enhancements that appeared in Version 2 of the protocol.
The first configuration example in this recipe uses plain-text authentication. In general, we recommend using the MD5 authentication because the plain-text version is far too easy to break. If you want to set up authentication to ensure that you receive updates only from the appropriate devices, you should use the safer MD5 version. The only reason to consider the less secure plain-text version is if some of the RIP devices cannot support MD5. Because the RFC for RIP Version 2 only describes plain-text authentication, non-Cisco devices may not support MD5 authentication.
Both forms of RIP authentication help to ensure that only legitimate network equipment is allowed to take part in RIP updates. This is particularly important if you have network segments containing foreign devices that may corrupt the routing tables. This could happen because of malice, but it's also relatively easy for a misconfigured Unix workstation running the routed program to cause serious global routing problems.
When you enable plain-text authentication, the first route field in each update packet contains the authentication string instead of a route. This implies that each update packet can then hold a maximum of 24 route entries. Because the MD5 authentication scheme carries more information, it uses the first and last route fields in each update packet. So this leaves a maximum of 23 route entries per update packet.
In this example, the key is applied to an interface. This allows you to specify a different key for each network segment. However, there is nothing to stop you from using the same key on more than one interface, or even using a single key throughout the network.
The following debug traces were taken with authentication enabled. The first trace shows plain-text authentication and includes the password:
Router1#debug ip rip RIP protocol debugging is on Aug 12 02:08:03.386: RIP: received packet with text authentication oreilly Aug 12 02:08:03.390: RIP: received v2 update from 172.25.1.7 on FastEthernet0/0.1
The second trace shows an update containing MD5 authentication. In this case, the router is not able to decode the authentication string. Instead, it compares the encrypted password string with the encrypted version of its own password to see if they match. There are no known methods to uniquely reverse MD5 encryption:
Router3#debug ip rip RIP protocol debugging is on Aug 11 22:14:50 EDT: RIP: received packet with MD5 authentication Aug 11 22:14:50 EDT: RIP: received v2 update from 172.25.1.5 on Ethernet0
The show ip protocols command includes information about the authentication key chains:
Router3#show ip protocols
Routing Protocol is "rip"
Sending updates every 30 seconds, next due in 16 seconds
Invalid after 180 seconds, hold down 180, flushed after 240
Outgoing update filter list for all interfaces is
Incoming update filter list for all interfaces is
Redistributing: rip
Default version control: send version 2, receive version 2
Interface Send Recv Key-chain
Ethernet0 2 2 ORA
Routing for Networks:
172.25.0.0
Routing Information Sources:
Gateway Distance Last Update
172.25.1.5 120 00:00:01
Distance: (default is 120)
Router3#
If the router receives a RIP update that has an incorrect key (or no key at all), it will discard the packet, as shown in the following debug trace:
Router3#debug ip rip RIP protocol debugging is on Aug 11 22:17:07 EDT: RIP: ignored v2 packet from 172.25.1.5 (invalid authentication)
We will discuss key management schemes such as setting key lifetimes and using multiple keys when we look at EIGRP authentication in Chapter 7. The key management systems are identical in both cases.
|
|
|
| Top |