Router Configuration

配置RIP被动接口

Target:

   配置RIP被动接口用来过滤路由的条目，增强网络的安全性。

实验原理:

   使用被动接口，禁止在连接ISP路由器的接口上发送RIP更新。

实验拓扑图：

Step:

步骤1 在路由器上配置IP路由选择和IP地址。

RA#config t

RA(config)# interface FastEthernet 0/0

RA(config-if)#ip address 172.16.1.5 255.255.255.252

RA(config)#interface FastEthernet 0/1

RA(config-if)#ip address 172.16.1.1 255.255.255.252

RA(config)#interface Loopback 0

RA(config-if)#ip address 172.16.3.1 255.255.255.0

RB(config)#interface FastEthernet 0/0

RB(config-if)#ip address 172.16.1.9 255.255.255.252

RB(config)#interface FastEthernet 0/1

RB(config-if)#ip address 172.16.1.2 255.255.255.252

RB(config)#interface Loopback 0

RB(config-if)#ip address 172.16.2.1 255.255.255.0

RC(config)# interface FastEthernet 0/0

RC(config-if)#ip address 172.16.1.10 255.255.255.252

RC(config)# interface FastEthernet 0/1

RC(config-if)#ip address 172.16.1.6 255.255.255.252

RC(config)#interface Loopback 0

RC(config-if)#ip address 210.10.1.1 255.255.255.0

步骤2 配置RIP。

RA(config)# router rip

RA(config-router)# version 2

RA(config-router)#network 172.16.0.0

RA(config-router)#no auto-summary

RB(config)# router rip

RB(config-router)#version 2

RB(config-router)#network 172.16.0.0

RB(config-router)#no auto-summary

步骤3 配置被动接口。

RA(config)# router rip

RA(config-router)# passive-interface FastEthernet 0/0

RB(config)# router rip

RB(config-router)# passive-interface FastEthernet 0/0

步骤4 验证测试。

用debug ip rip packet send来测试RIP更新。

下面显示的是完成“步骤2”时的测试，这时可以从Fa0/0接口上发送会发现RIP的更新，这样对于安全和带宽都有影响。

RA#debug ip rip packet send

RA#Sep 7 00:15:07 RA %7: [RIP] Output timer expired to send reponse

Sep 7 00:15:07 RA %7: [RIP] Prepare to send MULTICAST response...

Sep 7 00:15:07 RA %7: [RIP] Building update entries on FastEthernet 0/0

Sep 7 00:15:07 RA %7: 172.16.1.0/30 via 0.0.0.0 metric 1 tag 0

Sep 7 00:15:07 RA %7: 172.16.1.8/30 via 0.0.0.0 metric 2 tag 0

Sep 7 00:15:07 RA %7: 172.16.2.0/24 via 0.0.0.0 metric 2 tag 0

Sep 7 00:15:07 RA %7: 172.16.3.0/24 via 0.0.0.0 metric 1 tag 0

Sep 7 00:15:07 RA %7: [RIP] Send packet to 224.0.0.9 Port 520 on FastEthernet 0/0

RB#debug ip rip packet send

Sep 7 00:21:57 RB %7: [RIP] Send packet to 224.0.0.9 Port 520 on FastEthernet 0/0

Sep 7 00:21:57 RB %7: [RIP] Prepare to send MULTICAST response...

Sep 7 00:21:57 RB %7: [RIP] Building update entries on FastEthernet 0/1

Sep 7 00:21:57 RB %7: 172.16.1.8/30 via 0.0.0.0 metric 1 tag 0

Sep 7 00:21:57 RB %7: 172.16.2.0/24 via 0.0.0.0 metric 1 tag 0

下面显示的是完成“步骤3”时的测试，这时RIP的更新只从Fa0/1接口上发送，不会从Fa0/0发送更新。

RA#debug ip rip packet send

RA#Sep 7 00:26:37 RA %7: [RIP] Output timer expired to send reponse

Sep 7 00:26:37 RA %7: [RIP] Prepare to send MULTICAST response...

Sep 7 00:26:37 RA %7: [RIP] Building update entries on FastEthernet 0/1

Sep 7 00:26:37 RA %7: 172.16.1.4/30 via 0.0.0.0 metric 1 tag 0

Sep 7 00:26:37 RA %7: 172.16.3.0/24 via 0.0.0.0 metric 1 tag 0

Sep 7 00:26:37 RA %7: [RIP] Send packet to 224.0.0.9 Port 520 on FastEthernet 0/1

Sep 7 00:26:37 RA %7: [RIP] Prepare to send MULTICAST response...

Sep 7 00:26:37 RA %7: [RIP] Building update entries on Loopback 0

Sep 7 00:26:37 RA %7: 172.16.1.0/30 via 0.0.0.0 metric 1 tag 0

Sep 7 00:26:37 RA %7: 172.16.1.4/30 via 0.0.0.0 metric 1 tag 0

Sep 7 00:26:37 RA %7: 172.16.1.8/30 via 0.0.0.0 metric 2 tag 0

Sep 7 00:26:37 RA %7: 172.16.2.0/24 via 0.0.0.0 metric 2 tag 0

Sep 7 00:26:37 RA %7: [RIP] Send packet to 224.0.0.9 Port 520 on Loopback 0

RB# debug ip rip packet send

Sep 7 00:35:57 RB %7: [RIP] Output timer expired to send reponse

Sep 7 00:35:57 RB %7: [RIP] Prepare to send MULTICAST response...

Sep 7 00:35:57 RB %7: [RIP] Building update entries on FastEthernet 0/1

Sep 7 00:35:57 RB %7: 172.16.1.8/30 via 0.0.0.0 metric 1 tag 0

Sep 7 00:35:57 RB %7: 172.16.2.0/24 via 0.0.0.0 metric 1 tag 0

Sep 7 00:35:57 RB %7: [RIP] Send packet to 224.0.0.9 Port 520 on FastEthernet 0/1

Sep 7 00:35:57 RB %7: [RIP] Prepare to send MULTICAST response...

Sep 7 00:35:57 RB %7: [RIP] Building update entries on Loopback 0

Sep 7 00:35:57 RB %7: 172.16.1.0/30 via 0.0.0.0 metric 1 tag 0

Sep 7 00:35:57 RB %7: 172.16.1.4/30 via 0.0.0.0 metric 2 tag 0

Sep 7 00:35:57 RB %7: 172.16.1.8/30 via 0.0.0.0 metric 1 tag 0

Sep 7 00:35:57 RB %7: 172.16.3.0/24 via 0.0.0.0 metric 2 tag 0

Sep 7 00:35:57 RB %7: [RIP] Send packet to 224.0.0.9 Port 520 on Loopback 0

【参考配置】

RA#show running-config

Building configuration...

Current configuration : 721 bytes

!

version RGNOS 10.1.00(4), Release(18443)(Tue Jul 17 20:50:30 CST 2007 -ubu1server)

hostname RA

!

enable secret 5 $1$db44$8x67vy78Dz5pq1xD

!

interface FastEthernet 0/0

ip address 172.16.1.5 255.255.255.252

duplex auto

speed auto

!

interface FastEthernet 0/1

ip address 172.16.1.1 255.255.255.252

duplex auto

speed auto

!

interface Loopback 0

ip address 172.16.3.1 255.255.255.0

!

router rip

version 2

passive-interface FastEthernet 0/0

network 172.16.0.0

no auto-summary

!

ip route 0.0.0.0 0.0.0.0 FastEthernet 0/0

!

line con 0

line aux 0

line vty 0 4

login

!

end

RB#show running-config

Building configuration...

Current configuration : 721 bytes

!

version RGNOS 10.1.00(4), Release(18443)(Tue Jul 17 20:50:30 CST 2007 -ubu1server)

hostname RB

!

enable secret 5 $1$db44$8x67vy78Dz5pq1xD

!

interface FastEthernet 0/0

ip address 172.16.1.9 255.255.255.252

duplex auto

speed auto

!

interface FastEthernet 0/1

ip address 172.16.1.2 255.255.255.252

duplex auto

speed auto

!

interface Loopback 0

ip address 172.16.2.1 255.255.255.0

!

router rip

version 2

passive-interface FastEthernet 0/0

network 172.16.0.0

no auto-summary

!

ip route 0.0.0.0 0.0.0.0 FastEthernet 0/0

!

line con 0

line aux 0

line vty 0 4

login

!

end

RC#show running-config

Building configuration...

Current configuration : 682 bytes

!

version RGNOS 10.1.00(4), Release(18443)(Tue Jul 17 20:50:30 CST 2007 -ubu1server)

hostname RC

!

enable secret 5 $1$db44$8x67vy78Dz5pq1xD

!

interface FastEthernet 0/0

ip address 172.16.1.10 255.255.255.252

duplex auto

speed auto

!

interface FastEthernet 0/1

ip address 172.16.1.6 255.255.255.252

duplex auto

speed auto

!

interface Loopback 0

ip address 210.10.1.1 255.255.255.0

!

ip route 172.16.2.0 255.255.255.0 FastEthernet 0/0

ip route 172.16.3.0 255.255.255.0 FastEthernet 0/1

!

line con 0

line aux 0

line vty 0 4

login

!

end