Configure the OSPF passive Interface
Target:
Configure the RIP passive interface to filter route entries to enhance network security.
Principle:
Use a passive interface. Do not send OSPF update and hello messages on the interface connecting to the server router.
Topology:
650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/05213931B-0.png "title =" 002.png"/>
Setp:
Step 1 configure IP Route Selection and IP address on the vro.
RA # config t
RA (config) # interface FastEthernet 0/0
RA (config-if) # ip address 172.16.1.5 255.255.255.252
RA (config) # interface FastEthernet 0/1
RA (config-if) # ip address 172.16.1.1 255.255.255.252
RA (config) # interface Loopback 0
RA (config-if) # ip address 172.16.3.1 255.255.255.0
RB (config) # interface FastEthernet 0/1
RB (config-if) # ip address 172.16.1.2 255.255.255.252
RB (config) # interface Loopback 0
RB (config-if) # ip address 172.16.2.1 255.255.255.0
RC (config) # interface FastEthernet 0/0
RC (config-if) # ip address 172.16.4.1 255.255.255.0
RC (config) # interface FastEthernet 0/1
RC (config-if) # I p address 172.16.1.6 255.255.255.252
Step 2 configure OSPF.
RA (config) # router ospf 10
RC (config-router) # network 172.16.1.0 0.0.0.3 area 0
RC (config-router) # network 172.16.1.4 0.0.0.3 area 0
RC (config-router) # network 172.16.3.0 0.0.255 area 0
RB (config) # router ospf 10
RB (config-router) # network 172.16.1.0 0.0.0.3 area 0
RB (config-router) # network 172.16.2.0 0.0.255 area 0
RC (config) # router ospf 10
RC (config-router) # network 172.16.1.4 0.0.0.3 area 0
RC (config-router) # network 172.16.4.0 0.0.0.255 area 0
Step 3 configure the passive interface.
RC (config-router) # passive-interface FastEthernet 0/0
Step 4 verify the test.
Use the debug ip ospf packet send to test the RIP update.
The following shows the test when step 2 is completed. Ospf update and hello messages are sent from the Fa0/0 interface, which affects both security and bandwidth.
RC # debug ip ospf packet send
Sep 7 01:56:21 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:56:26 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/0: 172.16.4.1, length 44
Sep 7 01:56:31 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:56:37 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/0: 172.16.4.1, length 44
Sep 7 01:56:40 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:56:47 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/0: 172.16.4.1, length 44
Sep 7 01:56:51 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:56:56 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/0: 172.16.4.1, length 44
Sep 7 01:57:01 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:57:07 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/0: 172.16.4.1, length 44
Sep 7 01:57:10 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:57:17 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/0: 172.16.4.1, length 44
Sep 7 01:57:21 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
The following shows the test when step 3 is completed. OSPF update and hello are only sent from the Fa0/1 interface, but not from the Fa0/0 interface.
RC # debug ip ospf packet send
Sep 7 01:58:16 RC % 7: SEND [LS-Upd]: 1 LSAs to destination 224.0.0.5
Sep 7 01:58:16 RC % 7: SEND [LS-Upd]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 76
Sep 7 01:58:21 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:58:31 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:58:40 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:58:50 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:58:59 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6,
Length 48
Sep 7 01:59:10 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:59:20 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:59:29 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:59:40 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:59:50 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 01:59:59 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 02:00:10 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Sep 7 02:00:20 RC % 7: SEND [Hello]: To 224.0.0.5 via FastEthernet 0/1: 172.16.1.6, length 48
Reference Configuration]
RA # show running-config
Building configuration...
Current configuration: 699 bytes
!
Version RGNOS 10.1.00 (4), Release (18443) (Tue Jul 17 20:50:30 CST 2007-ubu1server)
Hostname RA
!
Enable secret 5 $1 $ db44 $ 8x67vy78Dz5pq1xD
!
Interface FastEthernet 0/0
Ip address 172.16.1.5 255.255.255.252
Duplex auto
Speed auto
!
Interface FastEthernet 0/1
Ip address 172.16.1.1 255.255.255.252
Duplex auto
Speed auto
!
Interface Loopback 0
Ip address 172.16.3.1 255.255.255.0
!
Router ospf 10
Network 172.16.1.0 0.0.0.3 area 0
Network 172.16.1.4 0.0.3 area 0
Network 172.16.3.0 0.0.0.255 area 0
!
Line con 0
Line aux 0
Line vty 0 4
Login
!
End!
RB # show running-config
Building configuration...
Current configuration: 634 bytes
!
Version RGNOS 10.1.00 (4), Release (18443) (Tue Jul 17 20:50:30 CST 2007-ubu1server)
Hostname RB
!
Enable secret 5 $1 $ db44 $ 8x67vy78Dz5pq1xD
!
Interface FastEthernet 0/0
Duplex auto
Speed auto
Shutdown
!
Interface FastEthernet 0/1
Ip address 172.16.1.2 255.255.255.252
Duplex auto
Speed auto
!
Interface Loopback 0
Ip address 172.16.2.1 255.255.255.0
!
Router ospf 10
Network 172.16.1.0 0.0.0.3 area 0
Network 172.16.2.0 0.0.0.255 area 0
!
!
Line con 0
Line aux 0
Line vty 0 4
Login
!
End
RC # show running-config
Building configuration...
Current configuration: 660 bytes
!
Version RGNOS 10.1.00 (4), Release (18443) (Tue Jul 17 20:50:30 CST 2007-ubu1server)
Hostname RC
!
Enable secret 5 $1 $ db44 $ 8x67vy78Dz5pq1xD
!
Interface FastEthernet 0/0
Ip address 172.16.4.1 255.255.255.0
Duplex auto
Speed auto
!
Interface FastEthernet 0/1
Ip address 172.16.1.6 255.255.255.252
Duplex auto
Speed auto
!
Interface Loopback 0
!
Router ospf 10
Passive-interface FastEthernet 0/0
Network 172.16.1.4 0.0.3 area 0
Network 172.16.4.0 0.0.0.255 area 0
!
Line con 0
Line aux 0
Line vty 0 4
Login
This article is from the "Security_net" blog, please be sure to keep this http://yxh1157686920.blog.51cto.com/7743046/1286371