CCNPv7 ROUTE Lab8-2 Routing Protocol Authentication Instructor

CCNPv7 ROUTEChapter 8 Lab 8-2, Routing Protocol Authentication Instructor Version Topology Objectives  Secure EIGRP routing protocol using SHA authentication.  Secure OSPF routing protocol using SHA authentication. © 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 14 168. This document is Cisco Public. the commands available and output produced might vary from what is shown in this lab. R1 hostname R1 interface Loopback 0 description R1 LAN ip address 192. Note: This lab uses Cisco 1941 routers with Cisco IOS Release 15. R2. Cable the network as shown in the topology diagram.2 255. You can copy and paste the following configurations into your routers to begin.2 with IP Base.1 255.CCNPv7 ROUTE Lab 8-2.1.1.1.1. Page 2 of 14 .1.252 clock rate 128000 no shutdown exit ! end R2 hostname R2 ! interface Serial0/0/0 description R2 --> R1 ip address 10. R2. Using the addressing scheme in the diagram. Required Resources  3 routers (Cisco IOS Release 15. Erase the startup configuration and reload each router to clear previous configurations.255. All rights reserved. interfaces might be numbered differently than those listed. Depending on the router or switch model and Cisco IOS Software version.0 exit ! interface Serial0/0/0 description R1 --> R2 ip address 10.252 no shutdown exit interface Serial0/0/1 © 2014 Cisco and/or its affiliates.2 or comparable)  Serial and Ethernet cables Step 1: Configure loopbacks and assign addresses. you build a multi-router network and secure the routing protocols used between R1. You might need to alter the designations accordingly. Routing Protocol Authentication Background The In this lab.1 255. and R3 routers. Note: Depending on the router model.255.255. and R3.255.255. apply the IP addresses to the interfaces on the R1.255. 252 clock rate 128000 no shutdown exit ! end R3 hostname R3 ! interface Loopback0 description R3 LAN ip address 192.3 R2(config-router-af)# Jan 10 10:10:59.823: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.168.255.1.0 0. On R1. a. Page 3 of 14 .255. R1(config)# router eigrp ROUTE R1(config-router)# address-family ipv4 autonomous-system 1 R1(config-router-af)# network 10. Routing Protocol Authentication description R2 --> R3 ip address 10.255.168.0. On R2.1.3 R2(config-router-af)# network 10.0 0.0.3. In this step.1.0.2. This document is Cisco Public.0.0.1. R2(config)# router eigrp ROUTE R2(config-router)# address-family ipv4 autonomous-system 1 R2(config-router-af)# network 10.0.0.0.2.1.255 R1(config-router-af)# b.2.255.0 0.2.2. configure named EIGRP.0 0.1 (Serial0/0/0) is up: new adjacency R2(config-router-af)# c.0.3 R3(config-router-af)# network 192.2.0.1.255 R3(config-router-af)# © 2014 Cisco and/or its affiliates.0. configure named EIGRP.2.0 0.CCNPv7 ROUTE Lab 8-2.3 R1(config-router-af)# network 192. EIGRP SHA authentication can only be configured when using the named EIGRP method.0.1.3.2 255. you will configure named EIGRP. configure named EIGRP. All rights reserved.0 exit interface Serial0/0/1 description R3 --> R2 ip address 10.0 0. R3(config)# router eigrp ROUTE R3(config-router)# address-family ipv4 autonomous-system 1 R3(config-router-af)# network 10.1 255.1 255. On R3.255.168.255.252 no shutdown exit ! end Step 2: Configure named EIGRP routing.2. 0/24 [90/23796702] via 10.1. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). 100-byte ICMP Echos to 192.1.1. 100-byte ICMP Echos to 10. This document is Cisco Public. Sending 5. 100-byte ICMP Echos to 192.2.1. Verify the routing table of R1.1.2. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).2.3.2 +>(tcl)#192.2. Serial0/0/0 e. All rights reserved.2.1.1.168. 2 masks 10.1.1 10.2.0/30 [90/23796062] via 10.CCNPv7 ROUTE Lab 8-2. Sending 5.1 +>(tcl)#10. Sending 5. From the R1 router. 100-byte ICMP Echos to 10.1 +>(tcl)#10. round-trip min/avg/max = 28/28/28 Type escape sequence to abort.3.1.1. round-trip min/avg/max = 1/1/1 ms Type escape sequence to abort. run the following Tcl script to verify connectivity.2.795: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10. Serial0/0/0 192.1 10. Sending 5.2.1 +>(tcl)#} { ping $address } Type escape sequence to abort.1.1. round-trip min/avg/max = 28/28/28 © 2014 Cisco and/or its affiliates.2.2.1.1. round-trip min/avg/max = 28/28/28 Type escape sequence to abort.168.2. foreach address { 192.168.1.0. round-trip min/avg/max = 12/14/16 Type escape sequence to abort. Sending 5.3. 00:05:56. 00:05:44.168.2 +>(tcl)#10.2.168.1.2.2.1.1. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).1 +>(tcl)#10. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).1. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).2.168. 3 subnets.1.3. ms ms ms ms ms Page 4 of 14 . Sending 5.1 } { ping $address } R1(tcl)#foreach address { +>(tcl)#192. round-trip min/avg/max = 12/13/16 Type escape sequence to abort.2. Routing Protocol Authentication Jan 10 10:10:58. 100-byte ICMP Echos to 10.1.2.0/8 is variably subnetted.168.2.1 (Serial0/0/1) is up: new adjacency R3(config-router-af)# d.2. R1# show ip route eigrp | begin Gateway Gateway of last resort is not set D D R1# 10.2 192.1 10.2.0.1.1. 100-byte ICMP Echos to 10.2 10. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). 2 (Serial0/0/0) is down: authentication HMAC-SHA-256 configured R1(config-router-af-interface)# Notice how the adjacency with R2 has changed to down. troubleshoot. On R2. create the key chain to be used for authentication. enable authentication on the serial 0/0/0 interface of R1. Page 5 of 14 . enable authentication on the serial 0/0/0 and serial 0/0/1 interfaces of R2. Next.035: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10. On R1. Next. Routing Protocol Authentication R1(tcl)# Are the pings now successful? _______________________________________________________________________________ _______________________________________________________________________________ Yes. R2(config)# key chain NAMED-R1-Chain R2(config-keychain)# key 1 R2(config-keychain-key)# key-string secret-1 R2(config-keychain-key)# exit R2(config-keychain)# exit R2(config)# d.CCNPv7 ROUTE Lab 8-2. If not. R2(config)# router eigrp ROUTE R2(config-router)# address-family ipv4 autonomous-system 1 R2(config-router-af)# af-interface S0/0/0 R2(config-router-af-interface)# authentication key-chain NAMED-R2-Chain R2(config-router-af-interface)# authentication mode hmac-sha-256 secret-2 © 2014 Cisco and/or its affiliates. Step 3: Secure the named EIGRP routing process. This is because R1 no longer accepts the updates from R2 because they are not authenticated. All rights reserved. R1(config)# router eigrp ROUTE R1(config-router)# address-family ipv4 autonomous-system 1 R1(config-router-af)# af-interface S0/0/0 R1(config-router-af-interface)# authentication key-chain NAMED-R1-Chain R1(config-router-af-interface)# authentication mode hmac-sha-256 secret-2 R1(config-router-af-interface)# Jan 10 10:19:35. This document is Cisco Public. c. R1(config)# key chain NAMED-R1-Chain R1(config-keychain)# key 1 R1(config-keychain-key)# key-string secret-1 R1(config-keychain-key)# exit R1(config-keychain)# exit R1(config)# b. a.1. create the key chain to be used for authentication.1. 1 (Serial0/0/1) is up: new adjacency R3# f.2.1. Next.168. Serial0/0/0 192.2. e.1. This is because R2 no longer accepts the updates from R3 because they are not authenticated. However.1. Serial0/0/0 © 2014 Cisco and/or its affiliates.1.2. create the key chain to be used for authentication.455: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.2.1. the second information message is saying that the adjacency with R1 has been restored because they are now authenticating each other’s routing updates. This document is Cisco Public.0/24 [90/23796702] via 10. All rights reserved.CCNPv7 ROUTE Lab 8-2.299: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10. 3 subnets. R3(config)# router eigrp ROUTE R3(config-router)# address-family ipv4 autonomous-system 1 R3(config-router-af)# af-interface S0/0/1 R3(config-router-af-interface)# authentication key-chain NAMED-R3-Chain R3(config-router-af-interface)# authentication mode hmac-sha-256 secret-2 R3(config-router-af-interface)# Jan 10 10:28:17. enable authentication on the serial 0/0/1 interface of R3.1 (Serial0/0/0) is up: new adjacency R2(config-router-af-interface)# Notice how the first informational message is saying that the adjacency with R3 has changed to down. Verify the routing table of R1.2. 2 masks 10. R3(config)# key chain NAMED-R1-Chain R3(config-keychain)# key 1 R3(config-keychain-key)# key-string secret-1 R3(config-keychain-key)# exit R3(config-keychain)# exit R3(config)# f.0/8 is variably subnetted.3.0/30 [90/23796062] via 10. 00:01:56. On R3.503: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10. 00:08:18.2. Routing Protocol Authentication R2(config-router-af-interface)# exit R2(config-router-af)# af-interface S0/0/1 R2(config-router-af-interface)# authentication key-chain NAMED-R2-Chain R2(config-router-af-interface)# authentication mode hmac-sha-256 secret-2 R2(config-router-af-interface)# Jan 10 10:22:03.0.2 (Serial0/0/1) is down: authentication HMAC-SHA-256 configured R2(config-router-af-interface)# Jan 10 10:22:05.0.2.1. Page 6 of 14 . R1#show ip route eigrp | begin Gateway Gateway of last resort is not set D D R1# 10.2. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). h.2. Therefore.1.1 +>(tcl)#10. troubleshoot.168.1 10.2. 100-byte ICMP Echos to 192. Sending 5.1.1.CCNPv7 ROUTE Lab 8-2. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).168. round-trip min/avg/max = 28/28/28 Type escape sequence to abort. If not. All rights reserved.1 } { ping $address } R1(tcl)#foreach address { +>(tcl)#192.168. Sending 5.2.1 +>(tcl)#} { ping $address } Type escape sequence to abort. Sending 5.2. Sending 5.2.1.3.1. and R3 using the no router eigrp ROUTE command on all three routers. round-trip min/avg/max = 12/14/16 Type escape sequence to abort. This document is Cisco Public. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).1.1. foreach address { 192.2.1. round-trip min/avg/max = 28/28/28 R1(tcl)# ms ms ms ms ms Are the pings now successful? _______________________________________________________________________________ _______________________________________________________________________________ Yes.2 10.2.1.168.1.1.1. Routing Protocol Authentication g.1.2.168. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). round-trip min/avg/max = 1/1/1 ms Type escape sequence to abort.2.2 +>(tcl)#10. 100-byte ICMP Echos to 10.2.2. round-trip min/avg/max = 28/28/28 Type escape sequence to abort.168.1 +>(tcl)#10. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). 100-byte ICMP Echos to 192.1.1.3. round-trip min/avg/max = 12/14/16 Type escape sequence to abort.2.2 192. Next we will configure OSPF routing protocol authentication.1. R2. Sending 5.2.2 +>(tcl)#192.1. remove EIGRP from R1.1 10. 100-byte ICMP Echos to 10. R1(config)# no router eigrp ROUTE R1(config) © 2014 Cisco and/or its affiliates.1 10. 100-byte ICMP Echos to 10. From the R1 router. Page 7 of 14 . 100-byte ICMP Echos to 10.1.3. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). Sending 5. run the following Tcl script to verify connectivity.1 +>(tcl)#10.2.1. 0.0. On R1.2. configure OSPF. All rights reserved.1. Page 8 of 14 .0.3 area 0 R1(config-router)# b.3 area 0 R1(config-router)# d.2. round-trip min/avg/max = 1/1/1 ms Type escape sequence to abort.1 +>(tcl)#10.3.2. foreach address { 192.0. Cisco refers to this as OSPFv2 Cryptographic Authentication feature.0.1 10. configure OSPF. Since Cisco IOS Software Release 15.2 192. round-trip min/avg/max = 24/27/28 ms Type escape sequence to abort.1 10.0.0 0.2. Sending 5.168.0.255 area 0 R1(config-router)# network 10.1. 100-byte ICMP Echos to 10.2.3 area 0 R2(config-router)# c.1.1. timeout is 2 seconds: © 2014 Cisco and/or its affiliates.168.2 +>(tcl)#192.168.168. From the R1 router.0 0.1.255 area 0 R1(config-router)# network 10.3.0.4(1)T.1.168.1. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).2.1.3.2.1. This document is Cisco Public. OSPFv2 supports SHA hashing authentication using key chains.1.2.2 +>(tcl)#10.2. Sending 5. 100-byte ICMP Echos to 10.0 0.1.168.1 +>(tcl)#10.2. On R2.1.0. a.1. R2(config)# router ospf 1 R2(config-router)# network 10.168.0 0.CCNPv7 ROUTE Lab 8-2. run the following Tcl script to verify connectivity.2. Sending 5.1.1 +>(tcl)#10.1. Routing Protocol Authentication Step 4: Configure OSPF routing.1.2.0 0.1.1.3 area 0 R2(config-router)# network 10.0. R1(config)# router ospf 1 R1(config-router)# network 192.2 10.1 +>(tcl)#} { ping $address } Type escape sequence to abort.0 0.1.1.1 10.1. configure OSPF.2.0.1 } { ping $address } R1(tcl)#foreach address { +>(tcl)#192. R1(config)# router ospf 1 R1(config-router)# network 192. 100-byte ICMP Echos to 192. On R3. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).0.1. The feature prevents unauthorized or invalid routing updates in a network by authenticating OSPFv2 protocol packets using HMAC-SHA algorithms. round-trip min/avg/max = 12/14/16 Type escape sequence to abort.1. 100-byte ICMP Echos to 10. Routing Protocol Authentication !!!!! Success rate is 100 percent (5/5). On R1. Next. c. create the key chain to be used for authentication. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). This is because R1 no longer accepts the updates from R2 because they are not authenticated. Sending 5. troubleshoot.2. Nbr 10.1. round-trip min/avg/max = 28/28/28 Type escape sequence to abort.2. 100-byte ICMP Echos to 192. R2(config)# key chain SHA-CHAIN R2(config-keychain)# key 1 R2(config-keychain-key)# key-string secret-1 © 2014 Cisco and/or its affiliates.2.1 on Serial0/0/0 from FULL to DOWN.075: %OSPF-5-ADJCHG: Process 1. Sending 5. This document is Cisco Public. Step 5: Secure the OSPF routing protocol. enable authentication on the serial 0/0/0 interface of R1.2. R1(config)# interface s0/0/0 R1(config-if)# ip ospf authentication key-chain SHA-CHAIN R1(config-if)# Jan 10 11:08:34. round-trip min/avg/max = 12/14/16 Type escape sequence to abort. create the key chain to be used for OSPF authentication.2. All rights reserved.2.CCNPv7 ROUTE Lab 8-2. On R2.3. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). Page 9 of 14 . R1(config)# key chain SHA-CHAIN R1(config-keychain)# key 1 R1(config-keychain-key)# key-string secret-1 R1(config-keychain-key)# cryptographic-algorithm hmac-sha-256 R1(config-keychain-key)# exit R1(config-keychain)# exit R1(config)# b. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).2. Sending 5. OSPF will use the OSPFv2 Cryptographic Authentication. Neighbor Down: Dead timer expired Notice how the adjacency with R2 has changed to down. round-trip min/avg/max = 28/28/28 R1(tcl)# ms ms ms ms Are the pings now successful? _______________________________________________________________________________ _______________________________________________________________________________ Yes. 100-byte ICMP Echos to 10.168. a. If not. Verify the routing table of R1. This is because R2 no longer accepts the updates from R3 because they are not authenticated. R3(config)#interface s0/0/1 R3(config-if)#ip ospf authentication key-chain SHA-CHAIN R3(config-if)# Jan 10 11:09:20. Next.3. However.523: %OSPF-5-ADJCHG: Process 1.1.223: %OSPF-5-ADJCHG: Process 1.1 on Serial0/0/1 from LOADING to FULL.168. e. the second information message is saying that the adjacency with R3 has changed to down. Routing Protocol Authentication R2(config-keychain-key)# cryptographic-algorithm hmac-sha-256 R2(config-keychain-key)# exit R2(config-keychain)# exit R2(config)# d.168. R2(config)# interface s0/0/0 R2(config-if)# ip ospf authentication key-chain SHA-CHAIN R2(config-if)# exit R2(config)# R2(config)# interface s0/0/1 R2(config-if)# ip ospf authentication key-chain SHA-CHAIN R2(config-if)# Jan 10 11:08:42. On R3. Next. Neighbor Down: Dead timer expired Notice how the first informational message is saying that the adjacency with R1 has been restored because they are now authenticating each other’s routing updates. R1# show ip route ospf | begin Gateway Gateway of last resort is not set © 2014 Cisco and/or its affiliates.2. create the key chain to be used for authentication. All rights reserved. Nbr 192. Page 10 of 14 . Nbr 192.2. R3(config-router)# key chain SHA-CHAIN R3(config-keychain)# key 1 R3(config-keychain-key)# key-string secret-1 R3(config-keychain-key)# cryptographic-algorithm hmac-sha-256 R3(config-keychain-key)# exit R3(config-keychain)# exit R3(config)# f.1 on Serial0/0/1 from FULL to DOWN.487: %OSPF-5-ADJCHG: Process 1.1 on Serial0/0/0 from LOADING to FULL. This document is Cisco Public.CCNPv7 ROUTE Lab 8-2. enable authentication on the serial 0/0/1 interface of R3. enable authentication on the serial 0/0/0 and serial 0/0/1 interfaces of R2. Nbr 10. Loading Done R2(config-if)# Jan 10 11:09:14. Loading Done R3# e. 1.2. 00:05:23.2.2 192.1 } { ping $address } R1(tcl)#foreach address { +>(tcl)#192. This document is Cisco Public.1. 100-byte ICMP Echos to 10.2. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).3. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).168.1.2.0. All rights reserved. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). Sending 5.168. Sending 5.1.1. round-trip min/avg/max = 12/14/16 Type escape sequence to abort. R1# show ip ospf interface s0/0/0 | section Crypto Cryptographic authentication enabled Sending SA: Key 1.1.168. 1 subnets 192.0.1.2.2.2 10.1.1.1 +>(tcl)#10.1.1.1.CCNPv7 ROUTE O O R1# f.1.1.3. Algorithm HMAC-SHA-256 .1.2.0/32 is subnetted.3.1.0/8 is variably subnetted.1.2.0/30 [110/128] via 10. ms ms ms ms Page 11 of 14 . 100-byte ICMP Echos to 10.2 +>(tcl)#10.1 +>(tcl)#10.1.1 10.2.2. Sending 5.key chain SHA-CHAIN R1# g. © 2014 Cisco and/or its affiliates.1 10.2. 100-byte ICMP Echos to 10.2.1. round-trip min/avg/max = 12/14/16 Type escape sequence to abort.2.1 10. From the R1 router. foreach address { 192.168. round-trip min/avg/max = 1/1/1 ms Type escape sequence to abort.2.2. Serial0/0/0 Verify the routing table of R1.1 [110/129] via 10.168. Sending 5.168.168. round-trip min/avg/max = 28/28/28 Type escape sequence to abort.1. 100-byte ICMP Echos to 192. 00:04:23. run the following Tcl script to verify connectivity.1. Serial0/0/0 192. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).1 +>(tcl)#10.2. Routing Protocol Authentication 10. 100-byte ICMP Echos to 10. 3 subnets. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5).3. Sending 5.2. 2 masks 10.2.1. round-trip min/avg/max = 28/28/28 Type escape sequence to abort. Lab 8-2.2 +>(tcl)#192.1 +>(tcl)#} { ping $address } Type escape sequence to abort. 3. Routing Protocol Authentication Sending 5.CCNPv7 ROUTE Lab 8-2.168. round-trip min/avg/max = 28/28/28 ms R1(tcl)# Are the pings now successful? _______________________________________________________________________________ _______________________________________________________________________________ Yes. If not. troubleshoot. timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5). All rights reserved. This document is Cisco Public.1. © 2014 Cisco and/or its affiliates. 100-byte ICMP Echos to 192. Page 12 of 14 . Routing Protocol Authentication Device Configurations (Instructor version) Router R1 hostname R1 ! key chain NAMED-R1-Chain key 1 key-string secret-1 key chain SHA-CHAIN key 1 key-string secret-1 cryptographic-algorithm hmac-sha-256 ! interface Loopback0 description R1 LAN ip address 192.0.3 area 0 network 10.1.255.0 0.1 255.0.255.252 ip ospf authentication key-chain SHA-CHAIN clock rate 128000 ! router ospf 1 network 10.0.255.252 ip ospf authentication key-chain SHA-CHAIN ! interface Serial0/0/1 description R2 --> R3 ip address 10.0.1.1 255.1 255.3 area 0 © 2014 Cisco and/or its affiliates.0 0.1.2.255.0.2.252 ip ospf authentication key-chain SHA-CHAIN clock rate 128000 ! router ospf 1 network 10.0 0.1. Page 13 of 14 . All rights reserved.1.1.255.1.2.255.0.1.3 area 0 network 192.168.CCNPv7 ROUTE Lab 8-2.0.1.0 ! interface Serial0/0/0 description R1 --> R2 ip address 10.255 area 0 ! end Router R2 hostname R2 ! key chain NAMED-R2-Chain key 1 key-string secret-1 ! key chain SHA-CHAIN key 1 key-string secret-1 cryptographic-algorithm hmac-sha-256 ! interface Serial0/0/0 description R2 --> R1 ip address 10.255.0 0.0.2.1. This document is Cisco Public.2 255.168.255. 2 255. Page 14 of 14 .3.255.1 255.252 ip ospf authentication key-chain SHA-CHAIN ! router ospf 1 network 10. Routing Protocol Authentication ! end Router R3 hostname R3 ! key chain NAMED-R3-Chain key 1 key-string secret-1 ! key chain SHA-CHAIN key 1 key-string secret-1 cryptographic-algorithm hmac-sha-256 ! interface Loopback0 description R3 LAN ip address 192. All rights reserved.2.2.CCNPv7 ROUTE Lab 8-2.0.255.0.2.3 area 0 network 192.255.0 0.255.168.168.0 0.0. This document is Cisco Public.255 area 0 ! end © 2014 Cisco and/or its affiliates.3.2.0 ! interface Serial0/0/1 description R3 --> R2 ip address 10.0.