江浙沪招生考试网

为什么非要加入密钥验证部分，因为现实中它基本上是必须的
[P1&P2&BBR]通用部分
[P1R2|P2R1|P2R2]配置都是这样，不再阐述

[BBR1] int s1/0 no ip add no shut int s1/0.1 mu ip add 10.0.0.1 fr map ip 10.0.0.2 301 br fr map ip 10.0.0.3 302 br ip rip auth key cisco ip rip auth mod md5 [BBR2] int s1/0 no ip add no shut int s1/0.1 mu ip add 11.0.0.1 fr map ip 11.0.0.2 604 br fr map ip 11.0.0.3 605 br ip rip auth key cisco ip rip auth mod md5

    验证结果：
   

[Copy to clipboard] CODE: sh ip route R 200.200.200.0/24 [120/2] via 219.146.241.2, 00:00:02, FastEthernet0/0 R 100.0.0.0/8 [120/1] via 11.0.0.2, 00:00:01, Serial1/0.1 R 172.17.0.0/16 [120/3] via 11.0.0.3, 00:00:00, Serial1/0.1 R 172.16.0.0/16 [120/1] via 11.0.0.3, 00:00:00, Serial1/0.1 R 172.19.0.0/16 [120/1] via 11.0.0.3, 00:00:00, Serial1/0.1 R 172.18.0.0/16 [120/2] via 11.0.0.3, 00:00:00, Serial1/0.1 C 219.146.241.0/24 is directly connected, FastEthernet0/0 R 192.168.4.0/24 [120/3] via 219.146.241.2, 00:00:02, FastEthernet0/0 R 10.0.0.0/8 [120/1] via 219.146.241.2, 00:00:02, FastEthernet0/0 C 11.0.0.0/8 is directly connected, Serial1/0.1 R 192.168.1.0/24 [120/2] via 219.146.241.2, 00:00:02, FastEthernet0/0 R 192.168.2.0/24 [120/2] via 219.146.241.2, 00:00:02, FastEthernet0/0 R 192.168.3.0/24 [120/3] via 219.146.241.2, 00:00:02, FastEthernet0/0 BBR上面sh fr map [Copy to clipboard] CODE: BBR2#sh fr map key chain cisco key 1 key-string mypass int x/x.x ip rip auth key cisco ip rip auth mod md5 [P1R1] int s1/0 ip add 10.0.0.2 255.0.0.0 no shut ip rip auth key cisco ip rip auth mod md5 encpa fr fr map ip 10.0.0.1 103 br

    [P1R2|P2R1|P2R2]配置都是这样，不再阐述
   

[BBR1] int s1/0 no ip add no shut Serial1/0.1 (up): ip 11.0.0.2 dlci 604(0x25C,0x94C0), static, broadcast, CISCO, status defined, active Serial1/0.1 (up): ip 11.0.0.3 dlci 605(0x25D,0x94D0), static, broadcast, CISCO, status defined, active

    注意：
    1.定义密钥，不需要在每台router上全部设定，这样是没有意义的重复劳动，在此网络结构中，只需要在P1,P2还有BBR区域的边界路由器上的边界端口设定key验证，现实当中也一样，不管跑什么协议，除非是不支持此功能的，否则为了安全起见，至少边界路由器要设定验证
    2.此结构中的BBR区域桢中继采用点到多点接口，所以，密钥的实现一定要在子接口里面实现，如果在物理接口上去敲命令，那么你debug肯定会告诉你invaild auth
    知识点：
    桢中继交换机配置
    定义交换机frame switch
    进入端口
    no ip no shut
    封装frame
    定义frame intf-type dce
    定义lmi
    定义clockrate
    定义frame route 100 interface s1/1 200
    典型配置
   

interface Serial1/0 no ip address encapsulation frame-relay no fair-queue serial restart-delay 0 clock rate 64000 frame-relay intf-type dce frame-relay route 100 interface Serial1/1 200 frame-relay route 600 interface Serial1/2 500 ! interface Serial1/1 no ip address encapsulation frame-relay serial restart-delay 0 clock rate 64000 frame-relay intf-type dce frame-relay route 200 interface Serial1/0 100 frame-relay route 300 interface Serial1/2 400 ! interface Serial1/2 no ip address encapsulation frame-relay serial restart-delay 0 clock rate 64000 frame-relay intf-type dce frame-relay route 400 interface Serial1/1 300 frame-relay route 500 interface Serial1/0 600